# Rsyslog server =\> Haproxy =\> ES cluster

**URL:** <https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752>\
**Category:** Elasticsearch\
**Created:** [August 3, 2015, 9:36pm UTC](https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752 "2015-08-03T21:36:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![saif](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saif/32/37431_2.png) [@saif](https://discuss.elastic.co/u/saif)\
**Post date:** [August 3, 2015, 9:36pm UTC](https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752/1 "2015-08-03T21:36:30Z")

</div>

Hi all  
I use haproxy with keepalive for ES  
but I have some concerns

HAproxy config

global  
log 127.0.0.1 local0 notice  
chroot /var/lib/haproxy  
user haproxy  
group haproxy  
daemon  
maxconn 4000

defaults  
log global  
mode http  
option httplog  
option dontlognull  
option redispatch  
retries 3  
timeout client 35s  
timeout server 60s  
timeout connect 5s  
timeout http-keep-alive 10s

listen stats :9090  
mode http  
stats enable  
stats hide-version  
stats realm Haproxy\ Statistics  
stats uri /  
stats auth admin:XXXX

listen elasticsearch 10.XXX.XXX.121:9300  
mode tcp  
option tcpka  
option tcplog  
# balance leastconn - The server with the lowest number of connections receives the connection  
# balance roundrobin - Each server is used in turns, according to their weights.  
# balance source - Source IP hashed and divided by total weight of servers designates which server will receive the request  
balance roundrobin  
server es-1 10.XXX.XXX.104:9200 check  
server es-2 10.XXX.XXX.105:9200 check

keepalived config

vrrp\_script chk\_haproxy {  
script "killall -0 haproxy"  
interval 2  
weight 2  
}

vrrp\_instance VI\_1 {  
interface eth0  
state MASTER  
virtual\_router\_id 51  
priority 101  
virtual\_ipaddress {  
10.XXX.XXX.144  
}  
track\_script {  
chk\_haproxy  
}  
}

HAproxy work but  
one ES server appear in haproxy stats

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 4, 2015, 10:30pm UTC](https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752/2 "2015-08-04T22:30:14Z")

</div>

Can you elaborate please, what you are asking is not clear.

---

<div class="post-metadata">

**Author:** ![saif](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saif/32/37431_2.png) [@saif](https://discuss.elastic.co/u/saif)\
**Post date:** [August 5, 2015, 8:18am UTC](https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752/3 "2015-08-05T08:18:18Z")

</div>

HI,  
im using rsyslog server to send logs to ES  
that work fine but in the rsyslog parameter there are one output  
so im trying to use Haproxy and keepalived to set an VIP to my node master  
so im look'in for a solution to do this in HAproxy and keepalived or an other solution  
Thanks

---

<div class="post-metadata">

**Author:** ![saif](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saif/32/37431_2.png) [@saif](https://discuss.elastic.co/u/saif)\
**Post date:** [August 5, 2015, 10:16am UTC](https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752/4 "2015-08-05T10:16:13Z")

</div>

so i fixed the problem thank u any way

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 5, 2015, 11:37pm UTC](https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752/5 "2015-08-05T23:37:22Z")

</div>

How did you fix it, I'm sure others would be interested.

---

<div class="post-metadata">

**Author:** ![saif](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saif/32/37431_2.png) [@saif](https://discuss.elastic.co/u/saif)\
**Post date:** [August 6, 2015, 7:49am UTC](https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752/6 "2015-08-06T07:49:51Z")

</div>

HI  
yes of curse !  
I will write an article on the HA stack ERK ElasticSearch rsyslog server and Kibana  
with template rsyslog on ElasticSearch  
and also on the configuration server Rsyslog  
and on best practice  
because I use this stack to centralize logs ~ 3000 linux server and ~ 500 windows server

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:57pm UTC](https://discuss.elastic.co/t/rsyslog-server-haproxy-es-cluster/26752/7 "2017-07-05T23:57:09Z")

</div>