Deployment Architecture

HEC HWF behind AWS Loadbalancer. ELB or ALB?

brent_weaver
Builder

Hello all. I am wondering what’s the best choice for putting the HTTP event collector behind an AWS load balancer. It would seem to me that an application load balancer would be appropriate for HTTP traffic, as opposed to a traditional load balancer.

thoughts?

 

Labels (1)
0 Karma

MKozanic
Path Finder

Hi @brent_weaver,

Just wondering what you ended up using and how it went?

0 Karma

TheColorBlack
Path Finder

From personal experience I use application loadbalancers for all of my HEC endpoints exposed to the internet. Via loadbalancer configuration I expose TCP port 443 to the internet and forward TCP port 8088 (standard HEC port) to backend EC2 instances acting as Heavy Forwarders.

The security group attached to the loadbalancer allows inbound traffic from the external sources I expect (mainly AWS Kinesis Firehose address space) and the outbound portion of the security group rule allows communication with the subnets my EC2 instances sit in.

For healthcheck monitoring on the target group I monitor this endpoint "/services/collector/health" over HTTPS for successful HTTP response codes 200-299 with a 5 second timeout.

 

 

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...