Large distributed architecture deployment

[EugeneFenko]

Hi, I am planning to deploy a distributed architecture and need some advice.

Prerequisites

• It must have at least two data centers (multi-site).
• Sensors (forward node) are installed in branches
• Total incoming traffic is expected to be more than 10Gbit/s.

I have some questions and would appreciate any tips and advice on such a deployment scheme.

Questions about multi-site:

• Is it possible to install several Manager nodes in one grid in HA-mode?
• Is it possible to connect a forward node to different grids at the same time?

Questions about the highload:

• What type of node should be added in case of a large queue incoming logs?
• What type of node should be added in case of a large number of requests from SOC/Kibana for analytics?

Scheme for an example:

[dougburks]

Is it possible to install several Manager nodes in one grid in HA-mode?

We don't support multiple manager nodes at this time, but adding receiver nodes does provide redundancy in your log pipeline.

Is it possible to connect a forward node to different grids at the same time?

A forward node can only be managed by one grid, but in theory you could have it forward its protocol metadata logs to a separate grid. However, please keep in mind that the second grid would not be able to do things like pivot to full packet capture.