I have setup graylog proof of concept in our environment some time ago and as usual POC transitioned silently to production critical system
And now I want to create more production ready setup
Currently I have:
VM1(graylog itself) connected to elastic cluster (ES-1, ES-2, ES-3) and external mongo. Elastics and mongos have already horizontally scalable installations.
I want to create HA graylog setup, while keeping old endpoint for backward compatibility (VM1). My idea is to create 2+ graylog instances with virtual IP and configure them against current elastic cluster and current mongo. This means that new endpoint and old one are available for some period of time (same data is visible via both endpoints), thus giving us some head room to reconfigure current graylog clients (java apps, syslog senders, sidecars, etc) to use VIP. It would also give me time to figure out and test how to properly load balance inputs and perhaps other details with proper setup.
Might is cause some issues?
or is it safe to proceed with such plan?