I have a reference setup looks like this:
1 x Load Balancer node
3 x Graylog 3.2 + MongoDB nodes
8 x Elasticsearch nodes
I’m expecting significant increase of message sources number in the nearest future and want to be prepared for it. Could you please point me the right way to scale out my Graylog cluster? Is there some best practices or someting like that? Should I add identical nodes? Should I keep the odd number of MongoDB instances?
Thank you in advance!