Hi Team,
I want to share my ELK stack cluster configuration shown below asking you to review it and share your thoughts and answer some questions.
Elasticsearch nodes configuration for ELK SERVER A1 and ELK SERVER B1:
node.master: true
node.data: true
node.ingest: false
node.ml: false
xpack.ml.enabled: false
cluster.remote.connect: false
Elasticsearch nodes configuration for ELK SERVER A2 and ELK SERVER B2:
node.master: true
node.data: false
node.ingest: false
node.ml: false
xpack.ml.enabled: false
cluster.remote.connect: false
Data flow is:
- App servers in both datacenters push data via UDP to Logstashes (using UDP input plugin):
- those in DC A to Logstash on ELK SERVER A2
- those in DC B to Logstash on ELK SERVER B2
- Logstashes forward data to Elasticsearch data nodes:
- Logstash on ELK SERVER A2 to Elasticsearch data node on ELK SERVER A1
- Logstash on ELK SERVER B2 to Elasticsearch data node on ELK SERVER B1
-
Data is replicated between Elasticsearch data nodes on ELK SERVER A1 and ELK SERVER B1
-
Kibana instances are connected to:
- on ELK SERVER A1 to Elasticsearch data nodes on ELK SERVER A1
- on ELK SERVER B1 to Elasticsearch data nodes on ELK SERVER B1
My questions:
- Is it OK to push data from Logstashes to Elasticsearch data nodes ? If not, what is the best approach ?
- Is it OK for both Kibana instances to be connected as described above ?
- Or maybe all my configuration is not recommended and i should create all the ELK stack in another way ?
Thank you in advance !
Ged