Is it best practice to put Elasticsearch behind a LB in graylog.conf?

Currently, i use Graylog in Production stage with ~2TB in a day. In my configuration server.conf, i put settings like this elasticsearch_hosts = is a TCP LoadBalancer. And then behind that LB, there are 7 Elasticsearch servers.

Is it best practice to put all of my Elasticsearch servers behind LB in the graylog.conf ? or should i put the config like this
elasticsearch_hosts =,,,.... ?

I am affraid config elasticsearch_max_total_connections_per_route, or elasticsearch_socket_timeout, etc will not be useful because the elasticsearch to be hit as LB not real Elasticsearch.

I use Graylog v3.2.4, Elasticsearch v6.8.
Thank you for your time and help

1 Like

Elasticsearch performs its own load-balancing. Generally you would want to use these native capabilities instead of adding a separate LB.
So to answer your question: list all the individual nodes in the elasticsearch_hosts setting.


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.