Hi, I am setting up a cluster (or two)
The plan is to have nodes in the US and in EU
Looking through posts regarding HA I can see 3 ways this is implemented
Two clusters, logstash sends to Cluster A, Cluster B uses CCR to pull a copy of all the data. Failover involves reconfiguring logstash and cluster B to be primary.
One cluster with zoning to ensure at least one replica in each DC. Logstash could be configured to write to all nodes. Failover would be fully automatic.
Two separate clusters with logstash configured to write to both clusters. I read a post that implied logstash would stall in this scenario when the primary goes down.
Multiple ELK cluster output
All these solutions seem to offer an RPO of zero option 2 with a RTO of zero also.
Does a geographically distributed cluster affect performance ?
What is the benefit of CCR as opposed to zoning?
Any factors I am not considering?
Many thanks in advance.