# How to achieve high availability of ELK Stack?

**URL:** <https://discuss.elastic.co/t/how-to-achieve-high-availability-of-elk-stack/89326>\
**Category:** Logstash\
**Created:** [June 14, 2017, 8:24am UTC](https://discuss.elastic.co/t/how-to-achieve-high-availability-of-elk-stack/89326 "2017-06-14T08:24:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Post date:** [June 14, 2017, 8:24am UTC](https://discuss.elastic.co/t/how-to-achieve-high-availability-of-elk-stack/89326/1 "2017-06-14T08:24:44Z")

</div>

Hi Experts,

Sorry if I am asking this question in wrong group. I have Archsight CEF data which I will be ingesting into ES using LS . To achieve HA I have total 8 machines 2-ES, 2-LS(these also have syslog-ng), 2-Kibana and 2-Nginx(for reverse proxy and load balance).

Now, In the above architecture I am not able to distribute traffic equally between two syslog-ng/LS machines in round-robin method from Nginx. So below is what I want to achieve  
CEF DATA -\> NGINX INSTANCE ----REDIRECT(load balance) ---\> syslog-SERVER 1(LS1) AND syslog-SERVER 2 (LS2).

Can someone help me to achieve highly available ELK stack without duplicating data.I already checked [https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html](https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html) but no luck yet .

Regards  
Vikas

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 14, 2017, 9:16am UTC](https://discuss.elastic.co/t/how-to-achieve-high-availability-of-elk-stack/89326/2 "2017-06-14T09:16:33Z")

</div>

> Now, In the above architecture I am not able to distribute traffic equally between two syslog-ng/LS machines in round-robin method from Nginx.

Why not? What's the problem?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 14, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-achieve-high-availability-of-elk-stack/89326/3 "2017-06-14T09:23:55Z")

</div>

In order to operate properly, Elasticsearch need an elected master node in the cluster. If this is not available the cluster is not able to accept writes as this could lead to data loss. Masters are elected by a majority of master eligible nodes, which means that you will need at least 3 Elasticsearch nodes in order to achieve HA.

---

<div class="post-metadata">

**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Post date:** [June 14, 2017, 9:52am UTC](https://discuss.elastic.co/t/how-to-achieve-high-availability-of-elk-stack/89326/4 "2017-06-14T09:52:28Z")

</div>

I know this is something to do with Nginx but while sending data to nginx on port 9516 I am getting below error .

> ```
> <html>
> <head><title>400 Bad Request</title></head>
> <body bgcolor="white">
> <center><h1>400 Bad Request</h1></center>
> <hr><center>nginx/1.4.6 (Ubuntu)</center>
> </body>
> </html>
> 
> ```

**here is my nginx.conf**

> upstream syslog-ng {  
> syslog-ng-server1:9516;  
> syslog-ng-server2:9516;  
> }

> server { # simple load balancing  
> listen 9516;  
> server\_name nginxIP;  
> location / {  
> proxy\_pass [http://syslog-ng](http://syslog-ng);  
> }  
> }

Would really appreciate if I can get any help on nginx conf .

---

<div class="post-metadata">

**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Post date:** [June 14, 2017, 9:55am UTC](https://discuss.elastic.co/t/how-to-achieve-high-availability-of-elk-stack/89326/5 "2017-06-14T09:55:03Z")

</div>

Thanks Christian,

I will take care of this .Actually problem is with data loadbalance . I am in good position with ES.

Regards  
VG

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2017, 9:55am UTC](https://discuss.elastic.co/t/how-to-achieve-high-availability-of-elk-stack/89326/6 "2017-07-12T09:55:07Z")

</div>

Closed on July 12, 2017, 9:55am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.