I want to setup multi-cluster to extend retention period to 1 year.
I had 500GB daily log
12 node Loginsight with 2TB space each node.
I have reached maximum configurations.
How can I expand them
I saw Vmware document
The design is extended through the addition of multiple forwarder clusters at remote sites or clusters. Each forwarder cluster is configured to forward all its log messages to the main cluster and users connect to the main cluster, taking advantage of CFAPI for compression and resilience on the forwarding path. Forwarder clusters configured as top-of-rack can be configured with a larger local retention.
Cross-Forwarding Central for Redundancy
This vRealize Log Insight deployment scenario includes a cluster with forwarder that is extended and mirrored. Two main clusters are used for indexing, storage, and query. One main cluster is in each data center. Each is front-ended with a pair of dedicated forwarder clusters. All log sources from all top-of-rack aggregations concentrate at the forwarder clusters. You can independently query the same logs on both retention clusters.
