We’re planning to move on from single node deployment. I plan to have two graylog nodes for redundancy, three es nodes and three mongo nodes to avoid split brain problem (am i right here?). Not planning to load balance graylog’s web interface, we don’t need it.
Balancing the messages traffic is a must though (not because of performance but HA is needed here), is nginx the only solution here?
I’m aware of udp load balancing problems when using GELF for example, but only thing we use udp for is syslog, does it have similar fragmentation related problems?
- is there any caching on this level possible?
- where do you place a load balancer to maximize HA? outside of the whole cluster?