How do I configure elastalert so it will connect to any server in the cluster? - elastalert

Question

How do I configure elastalert so it will connect to any available server in the cluster? The docs say:
es_host is the address of an Elasticsearch cluster where ElastAlert
will store data about its state, queries run, alerts, and errors. Each
rule may also use a different Elasticsearch host to query against.
but every example I can find just points to one IP address or hostname.
I have tried using a list of hostnames such as [elasticserver1, elasticserver2, elasticserver3], but that just causes elastalert to fail to start.

Answer 1

I guess you would need a upstream load balancer to wrap up those es nodes.
In my case, I use nginx to do load balancing for my es nodes. So the topology is something like this:
ElastAlert -> Nginx -> ES node 1
-> ES node 2
...
-> ES node n
Sample nginx config
upstream elasticsearch {
server {node 1}:9200;
server {node 2}:9200;
server {node n}:9200;
keepalive 15;
}
server {
listen 8080;
location / {
proxy_pass http://elasticsearch;
proxy_http_version 1.1;
proxy_set_header Connection "Keep-Alive";
proxy_set_header Proxy-Connection "Keep-Alive";
}
}
Sample elastalert config.yml
es_host: "{nginx ip}"
es_port: "8080"
Here is the article I read about how to work with nginx
https://www.elastic.co/blog/playing-http-tricks-nginx

Answer 2

As you identified in your answer elastalert targets a cluster not a node: "The hostname of the Elasticsearch cluster the rule will use to query."