UDP Load Balancer for graylog Gelf UDP

[derPhlipsi (Philipp Ruland)]

Hey @akhilbhardwaj89,

your problem is most likely the segmentation of UDP GELF.

GELF uses chunking for larger messages by segmenting the payload into multiple UDP messages with a sequence number. And the GELF specification states the following:

All chunks MUST arrive within 5 seconds or the server will discard all already arrived and still arriving chunks. A message MUST NOT consist of more than 128 chunks.

Additionally, it should be obvious that the chunks must arrive at the same server for them to get reassembled, else the message will be discarded instantly. So using round robin or similar load balancing will not work.
See here:

@jochen

Load-balancing GELF UDP is not exactly trivial because of its chunking characteristics. You would need to use client-based balancing, i. e. send all UDP packets by one client to the same Graylog input. Otherwise you’ll end up with corrupted messages.

You will need to setup a host-based / sticky balancing system.
Have a look here (the search functions helps )

How to balance udp inputs (GELF)

Hi all. We are using GELF (Udp) to collect messages. For HA we have created global inputs . So How we can balance udp gelf traffic between two nodes with health check ? is it possible? thanks

Greetings,
Philipp