# ELK Stack on AWS multi-region? **URL:** \ **Category:** Elasticsearch\ **Created:** [March 24, 2017, 2:10pm UTC](https://discuss.elastic.co/t/elk-stack-on-aws-multi-region/79898 "2017-03-24T14:10:45Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Post date:** [March 24, 2017, 2:10pm UTC](https://discuss.elastic.co/t/elk-stack-on-aws-multi-region/79898/1 "2017-03-24T14:10:45Z")
My App servers are deployed across 2 AWS regions, and I want to analyze their logs. I am planning architecture with high availability (1 region failure). So, planning to have: - Filbeat on each app server, - 2 Redis (1 in each region), - 2 Logstash Indexers (1 in each region), - Elasticsearch cluster spanning across 2 regions, - 2 Kibana (1 in each region). Picture of architecture : ![](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bdbb1beeeb79515e278e991ea13cefd67fd5c7b9.JPG) **I have below questions:** 1. Can Filebeat setup on app servers in one region communicate with Redis node on another region? Is this setup same as setting up redis-ouput plugin? (providing [hosts](https://www.elastic.co/guide/en/beats/filebeat/current/redis-output.html#_hosts_2) parameter with IP address of 2 Redis servers) or anything tricky about it. 2. Can Logstash Indexer ingest events from Redis server on another region? (is this same as providing 2 Redis input plugins for 2 Redis servers) 3. Can Logstash send events to Elasticsearch Data node on another region? 4. Can ES cluster span across 2 regions like the picture above? If I set [min.master.nodes](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery-zen.html#master-election)=3 this can handle 1 region failures, without causing split-brain problem? Will this continue to serve well once the region comes back? ( **This is where I have concerns about** ). Any help is appreciated. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 24, 2017, 2:19pm UTC](https://discuss.elastic.co/t/elk-stack-on-aws-multi-region/79898/2 "2017-03-24T14:19:06Z")
Have a look at the following blog post: [Clustering across multiple data centers](https://www.elastic.co/blog/clustering_across_multiple_data_centers) ---
**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Post date:** [March 24, 2017, 3:22pm UTC](https://discuss.elastic.co/t/elk-stack-on-aws-multi-region/79898/3 "2017-03-24T15:22:40Z")
@Christian_Dahlqvist Thanks a lot for sharing the link. !! I have a usecase where my app servers are in 2 regions (50% data in each region). But, if I use just 1 ES cluster (with Redis, Logstash, Kibana) in 1 region (say EAST), then will the filebeats installed on WEST servers be able to write data into Redis on EAST? In case of Disaster recovery (region failure), I want to spin up a new cluster from snapshots onto S3. Do you have any benchmark on the time it takes to restore ? ---
**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Post date:** [March 28, 2017, 2:25pm UTC](https://discuss.elastic.co/t/elk-stack-on-aws-multi-region/79898/4 "2017-03-28T14:25:44Z")
Under scenario one, it was quoted: > **Real-time Availability Across Geographic Regions** > Here you would have your application code write to a replicated queuing system (e.g. Kafka, Redis, RabbitMQ) and have a process (e.g. Logstash) in each DC reading from the relevant queue and indexing documents into the local Elasticsearch cluster. Instead of application code writing to replicated queuing systems, can I make filebeats write to replicated queuing systems? Like configuring 2 Redis output plugins on each of these fileabeats? (These 2 Redis servers will be in different regions). ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 28, 2017, 3:38pm UTC](https://discuss.elastic.co/t/elk-stack-on-aws-multi-region/79898/5 "2017-03-28T15:38:56Z")
Are all your inputs file-based? If that is the case you may not need Redis at all. ---
**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Post date:** [March 28, 2017, 5:33pm UTC](https://discuss.elastic.co/t/elk-stack-on-aws-multi-region/79898/6 "2017-03-28T17:33:33Z")
Yeah, So, in this case, if I remove Redis, all I need to do is send them to Logstash Indexers directly from filebeats. Can I provide 2 logstash indexers as outputs for filebeats without load balancing? I mean I want to setup 1 logstash indexer in each region, right, so can I configure filebeats so that each log event is sent to both logstash indexers? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 25, 2017, 5:33pm UTC](https://discuss.elastic.co/t/elk-stack-on-aws-multi-region/79898/7 "2017-04-25T17:33:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.