How to implement failover with merely Syslog over UDP

Elastic Stack Logstash
1

Hi

We have the following setup:
Syslog/UDP stream from all of our devices sent to two nginx-loadbalancers which forwards the UDP stream to two logstash nodes. This works great for load-balancing but not for failover. If one of the logstash machines for some reason goes offline, nginx will simply continue to send data to the offline node since its UDP.

I was wondering if the community has solved this in the past? And any general recommendations are welcome as well.

2

You will need to look to a VRRP/Keepalived solution. This article discusses and example of this...

3

Thanks! However, won't that eliminate the load-balancing aspect? It looks as a good solution other than its eliminating the load-balancing since only one logstash machine can be master.