# Haproxy in front of elasticsearch rest api on multinode cluster?

**URL:** <https://discuss.elastic.co/t/haproxy-in-front-of-elasticsearch-rest-api-on-multinode-cluster/218914>\
**Category:** Elasticsearch\
**Created:** [February 12, 2020, 8:05am UTC](https://discuss.elastic.co/t/haproxy-in-front-of-elasticsearch-rest-api-on-multinode-cluster/218914 "2020-02-12T08:05:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [February 12, 2020, 8:05am UTC](https://discuss.elastic.co/t/haproxy-in-front-of-elasticsearch-rest-api-on-multinode-cluster/218914/1 "2020-02-12T08:05:48Z")

</div>

Hi I've setup a 3 node elasticsearch cluster on different VMs locally on my laptop.

I use haproxy for loadbalancing.  
Connecting curl or kibana against the loadbalancer works fine, but logstash's monitoring pipeline is giving errors. I did not test with the real pipeline yet.  
Looks for me as if logstash wants to keep the connection open but with haproxy in the chain the connection gets closed and logstash seems not to recognize the closure correctly (or it is not forwarded to logstash correctly). So it hits an error and after a while it reconnects again.

I hope anyone of you is using haproxy in front of elasticsearch's rest api and you can provide your configuration. I am new to haproxy.

Mine looks like this:

```
global

    log 127.0.0.1 local2 debug
    log 127.0.0.1 local0 debug

    chroot /var/lib/haproxy
    pidfile /var/run/haproxy.pid
    maxconn 4000

    user haproxy
    group haproxy
    daemon
    stats socket /var/lib/haproxy/stats
    tune.ssl.default-dh-param 2048

defaults
    mode http
    log global
    option httplog
    option dontlognull
    option http-server-close
    option forwardfor except 127.0.0.0/8
    option redispatch
    retries 3
    timeout http-request 10s
    timeout queue 1m
    timeout connect 10s
    timeout client 1m
    timeout server 1m
    timeout http-keep-alive 10s
    timeout check 10s
    maxconn 3000

    
frontend ft_elasticsearch_http
    mode tcp
    option tcpka
    option tcplog
    bind 0.0.0.0:9201 name elasticsearch_http
    default_backend bk_elasticsearch_http

backend bk_elasticsearch_http
    mode tcp
    option httpchk HEAD / HTTP/1.1\r\nAuthorization:\ Basic\ aGVhbHRoY2hlY2s6aGVhbHRoMQ==
    http-check expect status 200
    option tcpka
    option tcplog

    default-server fall 2

    balance source
    option log-health-checks
    default-server inter 1s fall 2
    #server elastic03.internal.de_9200 elastic03.internal.de:9200 check check-ssl verify required ca-file /etc/haproxy/certs/ca/elasticsearch/elastic.pem inter 2s
    #server elastic02.internal.de_9200 elastic02.internal.de:9200 check check-ssl verify required ca-file /etc/haproxy/certs/ca/elasticsearch/elastic.pem inter 2s
    server elastic01.internal.de_9200 elastic01.internal.de:9200 check check-ssl verify required ca-file /etc/haproxy/certs/ca/elasticsearch/elastic.pem inter 2s

```

When I wireshark the connection without loadbalancer in the chain, I can see tcp keepalives, but with haproxy in between, I don't see any.

Thanks a lot, Andreas

---

<div class="post-metadata">

**Author:** ![Armin\_Braun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armin_braun/32/20092_2.png) [@Armin\_Braun](https://discuss.elastic.co/u/Armin_Braun)\
**Post date:** [February 12, 2020, 8:22am UTC](https://discuss.elastic.co/t/haproxy-in-front-of-elasticsearch-rest-api-on-multinode-cluster/218914/2 "2020-02-12T08:22:07Z")

</div>

Hi @asp

I think this is a known issue with Logstash, see [https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/814](https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/814)

There are some suggested workarounds for this in [https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/793](https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/793) but I can't speak to their validity to be honest.

Setting

```auto
      sniffing => false

```

for the Logstash ES output plugin may help though if the problem isn't so much with HAProxy dropping connections but rather Logstash trying to sniff for more endpoints? I'd check if you may have that setting on `true` (defaults to `false` also though)?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2020, 8:29am UTC](https://discuss.elastic.co/t/haproxy-in-front-of-elasticsearch-rest-api-on-multinode-cluster/218914/3 "2020-03-11T08:29:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.