# Questions on ELK architecture

**URL:** <https://discuss.elastic.co/t/questions-on-elk-architecture/156600>\
**Category:** Elasticsearch\
**Created:** [November 14, 2018, 8:09am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600 "2018-11-14T08:09:09Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [November 14, 2018, 8:09am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/1 "2018-11-14T08:09:09Z")

</div>

Hello there

I have a cluster with two node, the second node added recently and only has Elasticsearch installed. Both are running on two different aws instances. Instance 1 has ELK installed and instance 2 has only Elasticsearch installed. My question here is -

1. If the instance 1 goes down, is there a way (other than load balancing these two servers ) to view Kibana dashboard via instance 2? As of now there is only ES installed on ES 2.

2. Apart from replicating the data from 1st ES node to 2nd ES node, what other function does adding the second node serve ? Is it only for replication? If yes how does that work incase there are issues with ES of instance 1

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 14, 2018, 8:12am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/2 "2018-11-14T08:12:36Z")

</div>

1. You can edit the config to point to the other one. But a load balancer is better.
2. Replication = redundancy. It means you have more resources in the entire cluster, which improves performance.

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [November 14, 2018, 8:18am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/3 "2018-11-14T08:18:10Z")

</div>

Thank you for the response Mark!

1. Could you please point me to the page, if any OR tell me the settings that need to be done on how to edit the config to point to other to access kibana from second node. I could not find the right doc for this

Regards

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 14, 2018, 8:30am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/4 "2018-11-14T08:30:05Z")

</div>

Look at `elasticsearch.url` - [https://www.elastic.co/guide/en/kibana/current/settings.html](https://www.elastic.co/guide/en/kibana/current/settings.html)

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [November 14, 2018, 10:38am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/5 "2018-11-14T10:38:04Z")

</div>

Thank you Aaron!

I referred the link and tried making changes to elasticsearch url (in kibana.yml of 1st instance) by adding host ip of second instance. So, the setting was :

elasticsearch.url: "http://:9200"

But I still cannot access kibana with this second ip and port 5601 ob browser. Telnet and ping both works fine from node 1 to node 2 and vice versa.

Could you please suggest what would have gone wrong? not sure if i'm missing something here. I 'm using 5.6.11 version

Thanks

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [November 15, 2018, 5:03am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/6 "2018-11-15T05:03:01Z")

</div>

Hi Aaron, Can i please get some help on this as it has become a road block to configure my prod cluster.

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 19, 2018, 12:36am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/7 "2018-11-19T00:36:23Z")

</div>

> [@Eva](#):
>
> elasticsearch.url: "http://:9200"

That's not valid, it's missing the IP.

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [November 19, 2018, 6:16am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/8 "2018-11-19T06:16:16Z")

</div>

Hi Mark,

My apologies, that is something which I missed while replying to you. But my actual config does have the ip address and still doesn't seem to work.

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [November 19, 2018, 6:42am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/9 "2018-11-19T06:42:24Z")

</div>

So My first instance has ELK configured and the config is as below:

**Kibana.yml:**  
server.port: 5601  
server.host: "0.0.0.0"  
elasticsearch.url: "http://\<IP\_ad\_of\_node2\_running\_on\_different\_awsinstance\>:9200"  
elasticsearch.preserveHost: true

**elasticsearch.yml** of node 1  
cluster.name: NameEva  
node.name: ThisIsNode1  
network.host: 0.0.0.0  
http.port: 9200

Node 2 (on separate instance) with only ES and here is the es config

cluster.name: NameEva  
node.name: ThisIsNode2  
network.host: 0.0.0.0  
http.port: 9200  
discovery.zen.ping.unicast.hosts: ["private ip of node1 instance"]  
discovery.zen.minimum\_master\_nodes: 2

I'm able to access Kibana on port 5601 with the first node ip.

What am I missing here? Pls help

Thanks

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 19, 2018, 7:04am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/10 "2018-11-19T07:04:37Z")

</div>

What is the purpose of this configuration? If you are looking to achieve high availability you first and foremost will need at least 3 master-eligible Elasticsearch instances. You also most likely need two Kibana instances running on different hosts. Kibana can currently as far as I remember connect only to a single IP address, so have it connect to the local instance or use a load balancer.

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [November 19, 2018, 8:54am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/11 "2018-11-19T08:54:02Z")

</div>

Thank you Christian!

I'm aware of split brain scenario and the need for 3 nodes but for now i was trying to use Kibana through my second instance, just to check if I can access Kibana if node 1 is dead. Now I understand that the only option is to install Kibana on second node and use a load balance.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2018, 8:54am UTC](https://discuss.elastic.co/t/questions-on-elk-architecture/156600/12 "2018-12-17T08:54:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
