Multiple Datacenter Setup

Hi, on this FAQ page for multi-datacenter setup: http://docs.graylog.org/en/2.2/pages/faq.html.

"I have datacenters across the world and do not want logs forwarding from everywhere to a central location due to bandwidth, etc. How do I handle this?"
Answer: “You can have multiple graylog-server instances in a federated structure, and forward select messages to a centralized GL server.”

Can someone provide the documentation for a federated structure setup?

For smaller datacenters, will you still recommend a full production architecture, or will a minimum setup be sufficient?
(http://docs.graylog.org/en/2.2/pages/architecture.html)

This refers to the possibility to create a GELF output in Graylog and send the messages of all streams (or of the “All messages” stream) to another Graylog node, see System / Outputs in the Graylog web interface.

What is a “small” datacenter? How many clients, how many events per second (on average and in peak), and how big are the messages?

There are about 50 clients. On average there’s 1 event per second per node. So there are 50 events per second on average.

I do not have a good estimation of the peak but assume that’s double the size (100 events per second).

Each message is about 4KB.

Average: 10,000KB/s
Peak: 20,000KB/s

This is a load that a very small single node Graylog installation can handle (if you don’t care for high availability).

You could install the OVA on a machine with a few CPU cores and 4 GB of memory and it could handle the load.

What are these specifications for? That doesn’t match the 50 events per second (50 eps * 4 KB == 200 KB/s).

Thanks. At what number of clients/events per second would you recommend a full production setup (at least 2 graylog nodes with a load balancer, and at least 3 elasticsearch nodes)?

Please ignore the 2 values I provided earlier. Thanks.

That’s hard to say without all details and I’d rather not generalize this.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.