Writing to multiple Elasticsearch Nodes

Elastic Stack Logstash
1

I was just reading this article: https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html

I'm wondering how writing to multiple Elasticsearch nodes works in Logstash. In particular, let's assume I am shipping log events out of an single Logstash instance to 3 ELS Nodes. Like shown in the images here:
https://www.elastic.co/guide/en/logstash/current/static/images/deploy_4.png

What happens, if one of those ELS nodes becomes unavailable? Is logstash trying it again on the same node or does it "hand over" the event to the next available node?

2

A node that isn't available will be marked as "bad" for a while and Logstash will send requests to the remaining nodes.

3

Thanks Magnus, good to know... maybe you also know what is happening to the single event which is the first one to fail on a specific node. Is this single event lost?

Is there a documentation about the mechanism on how the elasticsearch output plugin marks nodes as bad. I'm interested to know how long a node is marked as bad until the output plugin is trying it again and so on...

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.