Recommended way to configure load balancer for HEC indexers in AWS

[vtalanki]

Hi,
We are setting up splunk in AWS and we currently have a cluster with 1 Master, 3 indexers, 1 deployer, 3 searchheads(includes 1 captain).
We do not use any forwarders and so enabled HEC in indexers. Now we are trying to setup a load balancer in front of indexers to send the data to be indexed.
Do we have any recommended way to configure this ELB of rindexers with HEC and no forwarders in AWS?
Below are few more questions I have

1. Which kind of LB is appropriate for this usecase - ALB or NLB. I think ALB is the correct one as it supports HTTP and HTTPS
2. How can we do the health checks - How can I configure ELB to have health checks for both the scenarios of 1. Indexer node going down and 2. Splunk/HEC going down in the indexer - in which case, the ELB should not route traffic to this node. Do I need to setup the ELB target as a lambda function to achieve this goal?

Any help is highly appreciated

[codebuilder]

If you are using indexer discovery, as you should be with an indexer cluster and master, there is not really any benefit to load balancing the indexers. The master will handle that for you. There are two methods, time based and volume based. The prior is likely best (every 30 seconds, etc. as opposed to every 10mb e.g.).

Enabling HEC on indexers directly is not good practice, imvho. Those should be dedicated nodes.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Forwarding/Setuploadbalancingd