it's possible balnce an hec source?

[aasabatini]

Hi Folks,

I have a question, I have 2 HF and I have to configure a hec source, I would balance the data across the two HF.

do you know the best pratices to do this?

Do i have to create the same inputs with the same token on both the HF and use a load balancer to do that?

Thanks in advance

[PickleRick · Accepted solution]

Yes, that's exactly how you do it. You create a HEC input with the same settings (token, destination index/permitted indexes, maybe TLS settings if you're not offloading it to your LB). And you just place your LB in front of those HECs. Works like a charm 🙂

[aasabatini]

Hi @PickleRick z, @gcusello ,

thanks for your confimation guys, just last question, do you know or exist some official documentation  about that? I mean the load balacing across the hec, no generic documentation.

[PickleRick]

I'm not sure there is any as such. This is more about HTTP in general, it's not specific to HEC as such. It's exactly the same as with any load-balanced service. You probably can find some .conf presentation mentioning it or something or event training materials but I don't think it _needs_ a specific official documentation. HTTP is generally proxable so there is no reason why HEC shouldn't.

[aasabatini]

Thanks @PickleRick 

[gcusello]

Ciao Alessandro,

yes, it's always better to use a Load Balancer to ingest syslogs: to distribute load during normal work and manage unavailability on one of them during fail over.

If you haven't a Load Balancer (always the best solution!) you could also use a DNS configuration, but it isn't so affidable because it takes some time to understand when an HF isn't available, so it looses some syslogs.

Then you configure on both the HFs the input with the same token.

Ciao.

Giuseppe