Round robin (DNS) instead of coordinating node?

OpenSearch
1

Hi,

I want to install an OpenSearch cluster in a small environment (~ 30 servers, ~10 switches). Currently we have a log arise around 1 gigabytes per day.
My plan is to install an cluster with only two nodes. Both machines have all the cluster roles.

I know the risks of installing a 2-node-cluster (e.g. split brain issue), but in our environment it’s not worth to run 3 nodes, I guess.

So my question is , if it’s possible to set one DNS-entry with both IP addresses for the clients. Since the index data is synchronized between the machines relatively quickly, this shouldn’t be a problem, right?

2

What are you using to ship logs to OpenSearch? A lot of clients can accept a list of OpenSearch endpoints and then you have to worry about keeping up with a DNS list.

1 Like
3

Beats and (r)syslog.
Beats shipper accept several OpenSearch Nodes, but for syslogs (Debian, switches) I don’t know, how to configure more than one remote syslog server (–> logstash).