Load balancing logs to graylog nodes

I need to configure load balancing of my java application logs onto my 3 graylog nodes.
Where and what all config changes needs to be made so that proper load balancing is achieved?
I have beats global inputs configured which is currently listening on 5044 port.
I am thinking of using nginx as my load balancer to send logs.
Will nginx work for this scenario?

Just stuck at how should i send my logs via LB. Read the docs but not able to understand . Would appreciate any help here with configuration or how the flow should be.

Will it work if I just include all my 3 hosts in the sidecar config of hosts and include loadbalancing: true. Will it handle itself in this case or Do I still need a LB?

Nginx can be a good option for this.
You can find configs for the web interface LB.
https://docs.graylog.org/en/3.1/pages/configuration/web_interface.html

Based on it, you can do the stream config for 5044, 514, etc ports.

Hi @macko003,
I have read this . I just want to know what all configs need to be done. Do i need to have a stream for beats input in nginx? Or having all my 3 hosts defined in sidecar config suffice my load balancing.

Consider i have 3 GL nodes and inputs running as below:

x.x.x.1:5044
x.x.x.2:5044
x.x.x.3:5044
So if i defing all these three in my output section of sidecar with loadbalancing: true will this work?

If I need to do nginx config for the same:
I should just create a stream for it say … upstream beat_input and then in sidecar config what should i mention as output…will it be my nginx Ip port right?

There are a lot of discourse in this forum about sidecar loadbalancing.
There are a lot of discourse in this forum about nginx configs.

YOU should make the decision about what is good for you. To do this you need to collect information. I suggest do this. Spend 1-2 hours to read, and I think after that you will have enought information about that.

I have experience with/opinion about nginx, with sidecars, with streams, etc, but it has no sense to write it again and again… And also many other people have it. I suggest collect it.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.