For those who interested in configuring local forwarders with prefferable destination and transparent failover, it's quite easy to do with haproxy. For server located in zoneA: {standard set of haproxy options} frontend fe-splunkfwd mode tcp option tcplog log global bind 127.0.0.1:7997 default_backend be-splunkfwd # For splunk forwarders backend be-splunkfwd mode tcp option tcplog timeout server 15s timeout connect 2s server fwd-server-name-zoneA 10.10.19.11:7997 maxconn 8192 check inter 1s server fwd-server-name-zoneB 10.19.20.11:7997 maxconn 8192 check inter 1s backup Change backup option in the be-splunkfwd backend respectively for server locate in zoneB. Of course it would work just fine with ELB, but on the other side local haproxy would give much better control of traffic. Nice to have it for a high logs throughput from host. ... View more