yesterday I tried to put a hardware loadbalancer (f5) in front of our 2 GL servers for a TCP input.
On the LB I set the virtual server with the correct TCP port (5555) and configured the GL nodes as backend with their corresponding global input on port 5555 with roundrobin.
I could see the open port with netstat and see incoming traffic with tcpdump on the LB.
On one node I could see traffic from the LB to the port (checked with tcpdump), but not on the other node.
On the input in the GL web interface I was able to see incoming traffic, but no messages were indexed.
We used a device which normally logs on a different input on our GL server.
1 GL server (want to put a second node in the cluster to distribute traffic)
3 node ES cluster
3 node MongoDB replica set
All servers are running CentOS7, version is “Graylog 2.5.1+34194da”, ES is still on 5.6.14, installed with RPMs
I hope someone can help us, I was only able to find “how to’s” with the GL web interface behind a LB.