Multiple master node adding in Elastalert

[ishukeshri2712]

I have a elasticsearch cluster which has 3 master nodes and data nodes and i want that i want my elastalert can able to send request to multiple master nodes because if one master failes i will not get alerts is there any way to add multiple master ? If yes can anyone tell me the procedure

[gregorywychowaniec-zt]

Hello,

Check the documentation. You can use the es_hosts parameter to specify multiple nodes of your Elasticsearch cluster.
You must still specify the primary host in the es_host parameter.

[gregorywychowaniec-zt]

Use something like that :

es_host: es-host
es_hosts:
  - es-host:9200
  - es-host2:9200
  - es-host3:9200
es_port: 9200

[ishukeshri2712]

Hi @gregorywychowaniec-zt can you tell me once how elastalert work. Suppose I created a rule which is querying over all the indexes nd we have put run_every 5 minutes so next time it will again query all the documents? And same question if I create 10 rules in which I m querying over all the documents so will it again query 10 times for all the I documents?

[ishukeshri2712]

Will the above will distribute the load among three master node in elasticsearch cluster?

[gregorywychowaniec-zt]

Hello,

It depends on the load of your cluster, you have to try by yourself and please read the docs before asking any questions. :)

[ishukeshri2712]

@gregorywychowaniec-zt hi I tried in a three node master cluster and it went down one of my master node and when I checked the heap dump it is pushing so much load on ELK what if I configure it for three and suppose my whole cluster went down?