High Availability with 2 DCs

[Muttley (Stuart Gall)]

Hi, I am setting up a cluster (or two)
The plan is to have nodes in the US and in EU

Looking through posts regarding HA I can see 3 ways this is implemented

1. Two clusters, logstash sends to Cluster A, Cluster B uses CCR to pull a copy of all the data. Failover involves reconfiguring logstash and cluster B to be primary.

2. One cluster with zoning to ensure at least one replica in each DC. Logstash could be configured to write to all nodes. Failover would be fully automatic.

3. Two separate clusters with logstash configured to write to both clusters. I read a post that implied logstash would stall in this scenario when the primary goes down.
   Multiple ELK cluster output

All these solutions seem to offer an RPO of zero option 2 with a RTO of zero also.

Does a geographically distributed cluster affect performance ?
What is the benefit of CCR as opposed to zoning?

Any factors I am not considering?

Many thanks in advance.

[Christian_Dahlqvist]

Option 2 is not supported so go with option 1 or 3. For option 3 it often helps adding a message queue like Kafka and have 2 Logstash instances each read from this and write to one cluster. This allows Kafka to buffer if one cluster is unavailable.