Hi 
Thanks for answering, OK, but what about the elasticsearch restart ? that's this part that worry me the most. I do node per node or do I need to edit the three elasticsearch.yml. I would like a more precise procedure.
I already use queuing but with rabbitmq
its logs ->rabbit ->logstash->ES<-kibana
When you say ssl on logstash, what does that mean ? I did a test on my dev environment (one node for everything) and came I just need to add user/pass in the output part ?
Anyway, thanks again for taking the time to answer me.
Best regards 