How to create a field include elk server name inside

Elastic Stack Logstash
1

we have 2 nodes elk cluster running. on the client server side, we point some of the servers to node 1, some to node 2, so far I dont have way to see whether the distribution is balanced or not.

I am thinking to create a field of ElkServer for each indexer so we can plot the chart to see whether the loading is balanced.

is there other ways to monitor the loading on each node?

2

we have 2 nodes elk cluster running. on the client server side, we point some of the servers to node 1, some to node 2, so far I dont have way to see whether the distribution is balanced or not.

I suggest you point all Logstash instances to all ES instances. Recent Logstash versions will automatically distribute requests across the specified servers.

is there other ways to monitor the loading on each node?

Marvel? Plus system monitoring tools like collectd, of course. Note that all shards receiving data will carry out the same work, so if your two-node cluster has one replica of all indexes I don't see how it would make much difference which node you connect to. (Also, you do know that two-node clusters are prone to split brain situations unless you only allow one of the nodes to be master?)

3

hi Magus, do you mean I can configure all the elk server nodes instead of one server in hosts?

output {
elasticsearch {
hosts => "fslelkprod02, fslelkprod01"
index => "host-%{+YYYY.MM.dd}"
workers => 4
}
}

4

Use

hosts => ["fslelkprod02", "fslelkprod01"]

but otherwise yes.

5

Thanks Magnus.