Tips about an upgrade of ELK Stack

Elastic Stack Elasticsearch
1

Hello,
I would like some advices / tips about my idea to upgrade the elk stack we are using.

At this moment, we have elasticsearch 6.3.0, kibana 6.3.0, logstash 6.3.0 and curator 5.6.
4 nodes :
Node 1 is elasticsearch, kibana, logstash and curator, it's a data, master and ingest node on site A
Node 2 is elasticsearch and master on site A
Node 3 is elasticsearch and master on site B
Node 4 is elasticsearch and data on site B

No problem with replication of shards.
We are using elk stack to centralize our windows logs and some linux servers.
Winlogbeats and filebeats are the most used beats. We have more 400gb of logs, so it's a little environment.

The first thing I have to do is to upgrade to the last version (6.6.2) and extend the drives, I have done a test with another cluster, it's OK.

But I was thinking to perform another tasks to perform this stack and I'm looking for some tips/ideas :

  • https, easy or not ? We have a pki; possible to send data to http until I change to https on each beat ?
  • no problem to have logstash on site A, and another logstash on site B, and all of them send data to the same elasticsearch data ?
  • possible to have two kibana ? How to handle this ?
  • good idea to separate logstash from elasticsearch ?
  • possible if servers on site A send data to elasticsearch on site A, and servers on site B send data to elasticsearch on site B ? I don't think it's a good idea, the cluster will always replicate data on other node, I'm just wondering about this idea
  • elastalert, I would like to use this to send alert. We have just to run docker to use this ?

If you have others ideas, don't hesitate to share with me :slight_smile:

Thanks

2

My first recommendation depends on how far apart site A and site B are. It is never recommended to have a cluster span data centers. If site A and site B are inside the same data center, then no big deal. Otherwise, this is not a recommended approach.

Why? Because in the event of a "backhoe event," that severs connectivity between data centers, you could lose data. If network traffic slows down between the two, you could have slow queries. If you end up having to re-replicate a shard on one side or the other, that can get expensive.

3

Thank you for reply ! I didn't think about a loss of network and, it will be a problem if I replicate site A to site B, and site B to site A.
Thank you for this advice !

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.