We have the following setup:
Syslog/UDP stream from all of our devices sent to two nginx-loadbalancers which forwards the UDP stream to two logstash nodes. This works great for load-balancing but not for failover. If one of the logstash machines for some reason goes offline, nginx will simply continue to send data to the offline node since its UDP.
I was wondering if the community has solved this in the past? And any general recommendations are welcome as well.