# Two physical location, same type of data, need solution for data

**URL:** <https://discuss.elastic.co/t/two-physical-location-same-type-of-data-need-solution-for-data/57139>\
**Category:** Elasticsearch\
**Created:** [August 3, 2016, 6:19pm UTC](https://discuss.elastic.co/t/two-physical-location-same-type-of-data-need-solution-for-data/57139 "2016-08-03T18:19:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gh0stid](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@gh0stid](https://discuss.elastic.co/u/gh0stid)\
**Post date:** [August 3, 2016, 6:19pm UTC](https://discuss.elastic.co/t/two-physical-location-same-type-of-data-need-solution-for-data/57139/1 "2016-08-03T18:19:54Z")

</div>

Hello all,

I have a good question, since im not sure to understand everything about "tribe node" Kafka and other thing like that... I assume its a good place to ask !

* * *

Lets say, I have two different site limited bandwidth BUT need to be able to "gather" logs from devices in two different site BUTTTTTT it needs to be in the same indices ( for now , lets call it Fortigate-YYYY.MM.DD )

( actualy doing it for one location and it work "great" using ng-syslog and logstash file input output to ES single node cluster, no replicas)

The actual puzzle :

Many different device are linked to one Fortianalyzer for the moment, wich stock logs --- Location A  
More devices connected to another fortianalyzer device in another location --- Location B

both need to be indexed in the same "index-\*" so I can view visualisation of all the device no matter what site they are located in. That, using the less ressources possible. ( in term of hardware and bandwitdth )

FailOver is not something vital, High Availability neighter, we only really need to be able to "gather" all the data and be able to search in it . fastest as possible

Think you could lend me a hand in a "setup" diagram or something ? I have read many thing.. but not sure where to stop.

Thank you !

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 4, 2016, 8:39am UTC](https://discuss.elastic.co/t/two-physical-location-same-type-of-data-need-solution-for-data/57139/2 "2016-08-04T08:39:08Z")

</div>

You either need to replicate the entire data, or use a tribe node.

[https://www.elastic.co/blog/scaling\_elasticsearch\_across\_data\_centers\_with\_kafka](https://www.elastic.co/blog/scaling_elasticsearch_across_data_centers_with_kafka) might help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:30pm UTC](https://discuss.elastic.co/t/two-physical-location-same-type-of-data-need-solution-for-data/57139/3 "2017-07-05T22:30:10Z")

</div>

Closed on July 5, 2017, 10:30pm UTC