Currently, i use Graylog in Production stage with ~2TB in a day. In my configuration server.conf, i put settings like this
elasticsearch_hosts = http://10.199.255.25:9200
10.199.255.25 is a TCP LoadBalancer. And then behind that LB, there are 7 Elasticsearch servers.
Is it best practice to put all of my Elasticsearch servers behind LB in the graylog.conf ? or should i put the config like this
elasticsearch_hosts = http://10.8.1.1:9200,http://10.8.1.2:9200,http://10.8.1.3:9200,....http://10.8.1.7:9200 ?
I am affraid config
elasticsearch_socket_timeout, etc will not be useful because the elasticsearch to be hit as LB not real Elasticsearch.
I use Graylog v3.2.4, Elasticsearch v6.8.
Thank you for your time and help