Do we have data loss when output destination is not available to receive data from haproxy

Help!
1

Hi All,

I am new to haproxy usage, i wanted to check one thing here.

In the below architecture, When output servers (in my case it is SIEM) are down and not able to receive any logs which are sent by logstash through haproxy.

Beat agents → Logstash → HA Proxy output → Multiple output destinations (SIEM)

We can’t stop the input flow from logstash to haproxy but the SIEM is not available to accept/receive logs from haproxy.

So does haproxy can keep the buffer of failed logs and resend it again ? or do we face log loss in this situation?

Would be much helpful if someone can help me in this. Thanks.

2

HAPROXY is not a message broker; if there is no backend available - nothing will be delivered and your messages will be lost - if not resend by your collector. You should take a look at rabbitmq for your problem.

3

Thanks for your answer.

We actually use other options like Kafka for buffer streaming but in some cases we are using haproxy load balancer. So wanted to check the data loss while using this.