topic Re: it's possible balnce an hec source? in Getting Data In

it's possible balnce an hec source?

aasabatini — Mon, 20 Feb 2023 11:52:28 GMT

Hi Folks,

I have a question, I have 2 HF and I have to configure a hec source, I would balance the data across the two HF.

do you know the best pratices to do this?

Do i have to create the same inputs with the same token on both the HF and use a load balancer to do that?

Thanks in advance

Re: it's possible balnce an hec source?

gcusello — Mon, 20 Feb 2023 11:57:23 GMT

Ciao Alessandro,

yes, it's always better to use a Load Balancer to ingest syslogs: to distribute load during normal work and manage unavailability on one of them during fail over.

If you haven't a Load Balancer (always the best solution!) you could also use a DNS configuration, but it isn't so affidable because it takes some time to understand when an HF isn't available, so it looses some syslogs.

Then you configure on both the HFs the input with the same token.

Ciao.

Giuseppe

Re: it's possible balnce an hec source?

PickleRick — Mon, 20 Feb 2023 12:21:40 GMT

Yes, that's exactly how you do it. You create a HEC input with the same settings (token, destination index/permitted indexes, maybe TLS settings if you're not offloading it to your LB). And you just place your LB in front of those HECs. Works like a charm 🙂

Re: it's possible balnce an hec source?

aasabatini — Mon, 20 Feb 2023 13:35:19 GMT

Hi @PickleRick z, @gcusello ,

thanks for your confimation guys, just last question, do you know or exist some official documentation about that? I mean the load balacing across the hec, no generic documentation.

Re: it's possible balnce an hec source?

PickleRick — Mon, 20 Feb 2023 13:40:57 GMT

I'm not sure there is any as such. This is more about HTTP in general, it's not specific to HEC as such. It's exactly the same as with any load-balanced service. You probably can find some .conf presentation mentioning it or something or event training materials but I don't think it _needs_ a specific official documentation. HTTP is generally proxable so there is no reason why HEC shouldn't.

Re: it's possible balnce an hec source?

aasabatini — Mon, 20 Feb 2023 13:43:06 GMT

Thanks @PickleRick