# Elastic clustering

**URL:** <https://discuss.elastic.co/t/elastic-clustering/174709>\
**Category:** Elasticsearch\
**Created:** [April 1, 2019, 5:45am UTC](https://discuss.elastic.co/t/elastic-clustering/174709 "2019-04-01T05:45:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cppatel](https://avatars.discourse-cdn.com/v4/letter/c/3ec8ea/32.png) [@cppatel](https://discuss.elastic.co/u/cppatel)\
**Post date:** [April 1, 2019, 5:45am UTC](https://discuss.elastic.co/t/elastic-clustering/174709/1 "2019-04-01T05:45:52Z")

</div>

Does Elasticsearch supports OS level clustering ? If it is so please provide a related document to refer it. We want that filebeat directly send an input to VIP. We are using 6.2.2 ELK stack.

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [April 1, 2019, 8:05am UTC](https://discuss.elastic.co/t/elastic-clustering/174709/2 "2019-04-01T08:05:58Z")

</div>

> [@cppatel](#):
>
> Does Elasticsearch supports OS level clustering ?

There is no need, because Elasticsearch clusters form at the application level.

> [@cppatel](#):
>
> We want that filebeat directly send an input to VIP.

The traffic from Filebeat into Elasticsearch is HTTP, so one simple way to achieve this is using a HTTP load balancer listening on the VIP.

---

<div class="post-metadata">

**Author:** ![cppatel](https://avatars.discourse-cdn.com/v4/letter/c/3ec8ea/32.png) [@cppatel](https://discuss.elastic.co/u/cppatel)\
**Post date:** [April 1, 2019, 9:10am UTC](https://discuss.elastic.co/t/elastic-clustering/174709/3 "2019-04-01T09:10:41Z")

</div>

> [@DavidTurner](#):
>
> The traffic from Filebeat into Elasticsearch is HTTP, so one simple way to achieve this is using a HTTP load balancer listening on the VIP.

Thank you David. In our environment filebeat is sending the data to the logstash from different sources. Also a whole ELK is installed on a same server. We got 2 servers for now as a purpose of doing clustering . So, we would have 2 ELK's at the end. Now, If we use HTTP load balancer listening on the VIP, How logstash is going to flow the output (parsed data) to the elasticsearch ? In a random manner or in a synchronized manner? I mean to ask is would I be able to access the same data on both ELK nodes or data would be distributed among those 2 ELKS?  
Please guide regarding this.

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [April 1, 2019, 9:44am UTC](https://discuss.elastic.co/t/elastic-clustering/174709/4 "2019-04-01T09:44:07Z")

</div>

> [@cppatel](#):
>
> we would have 2 ELK's at the end

I don't know what you mean by "2 ELKs". Do you mean you will have a 2-node Elasticsearch cluster? The term "ELK" is ambiguous here.

> [@cppatel](#):
>
> How logstash is going to flow the output (parsed data) to the elasticsearch

You can write data to any node in a cluster and it will be routed correctly.

> [@cppatel](#):
>
> would I be able to access the same data on both ELK nodes

Yes, you can access the same data from any node in a cluster.

> [@cppatel](#):
>
> or data would be distributed among those 2 ELKS?

Yes, Elasticsearch distributes the data amongst the nodes in the cluster in an intelligent fashion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2019, 9:44am UTC](https://discuss.elastic.co/t/elastic-clustering/174709/5 "2019-04-29T09:44:15Z")

</div>

Closed on April 29, 2019, 9:44am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.