Load Balanced Inputs / Source IP

Graylog Central (peer support)
1

Hello,

I am planning a Graylog installation with 4 nodes (2 GL, 2 ES). Primary reason is to distribute load and be able to scale out with additional nodes if load increases.

To distribute inputs (Beats, Syslog, SNMP) to both GL nodes an external load balancer will be used. During my tests I noticed that source field is set with load balancer IP instead of source hosts. With beats its no problem, as filebeat writes its local hostname in another field. But syslog does not and so I do not know who is sending the data.

How do you handle that?

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.