# Best approach
**URL:** https://discuss.elastic.co/t/best-approach/22466
**Category:** Elasticsearch
**Created:** [March 2, 2015, 1:33pm UTC](https://discuss.elastic.co/t/best-approach/22466 "2015-03-02T13:33:08Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@tara\_Gowda](https://discuss.elastic.co/u/tara_Gowda)
#### Post date: [March 2, 2015, 1:33pm UTC](https://discuss.elastic.co/t/best-approach/22466/1 "2015-03-02T13:33:08Z")
Hi All,
I am new/novice to this world of ellasticsearch. i have few
queries in this regard
1. I have installed elasticsearch and started it on my ubunut machine.
everything is well and good. it is binded to some ip.
2. i used mozilla rest client to check its REST service and i get response
for HTTP POST. i am ok with it.
3. i started kibana and pointing towards the elasticsearch url at 9020. it
is running well and ok with it.
prblems
1. what i see is IP of the interface to which elasticearch is binded has
moved from .17 to .23 in span of 1 hour. I checked the dhcp settings of my
router and i see it is set to 86400 seconds, so it should stay for 1 full
day. I gave static ip and entered into MAC table of router, so far things
are stable. is the IP moving expected behaviour ?
objective
5. my objective is to collect logs generated on a console and put them into
elasticsearch and use kibana to display. do i have to mandatorily convert
the console logs/lines to JSON format before feeding them as HTTP POST to
elasticsearch url? also, please suggest the best possible way to do it?
6. also please correct my understand, since elasticsearch is up and
running, i can feed in any JSON structured data, say my first JSON
structure may have different elements and second JSON structure has
different elements and third...so..on.
7. in above [point 6] case, do i have create to EACH node for every
different type of JSON structure or is the ONE node is sufficient for
different types of JSON structures?
Thanks
Tara
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d03a4d85-969f-492b-bea3-52984325339b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d03a4d85-969f-492b-bea3-52984325339b%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@tara\_Gowda](https://discuss.elastic.co/u/tara_Gowda)
#### Post date: [March 2, 2015, 10:52pm UTC](https://discuss.elastic.co/t/best-approach/22466/2 "2015-03-02T22:52:09Z")
Hi All,
I am awaiting your reply/help. please reply
Thanks
Tara
On Monday, March 2, 2015 at 8:33:08 AM UTC-5, tara Gowda wrote:
> Hi All,
> I am new/novice to this world of ellasticsearch. i have few
> queries in this regard
>
> 1. I have installed elasticsearch and started it on my ubunut machine.
> everything is well and good. it is binded to some ip.
> 2. i used mozilla rest client to check its REST service and i get response
> for HTTP POST. i am ok with it.
> 3. i started kibana and pointing towards the elasticsearch url at 9020. it
> is running well and ok with it.
>
> prblems
>
> 1. what i see is IP of the interface to which elasticearch is binded has
> moved from .17 to .23 in span of 1 hour. I checked the dhcp settings of my
> router and i see it is set to 86400 seconds, so it should stay for 1 full
> day. I gave static ip and entered into MAC table of router, so far things
> are stable. is the IP moving expected behaviour ?
>
> objective
> 5. my objective is to collect logs generated on a console and put them
> into elasticsearch and use kibana to display. do i have to mandatorily
> convert the console logs/lines to JSON format before feeding them as HTTP
> POST to elasticsearch url? also, please suggest the best possible way to do
> it?
> 6. also please correct my understand, since elasticsearch is up and
> running, i can feed in any JSON structured data, say my first JSON
> structure may have different elements and second JSON structure has
> different elements and third...so..on.
> 7. in above [point 6] case, do i have create to EACH node for every
> different type of JSON structure or is the ONE node is sufficient for
> different types of JSON structures?
>
> Thanks
> Tara
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8cec1041-0245-4c2e-96bc-3520f2b88e15%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8cec1041-0245-4c2e-96bc-3520f2b88e15%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 3, 2015, 4:35am UTC](https://discuss.elastic.co/t/best-approach/22466/3 "2015-03-03T04:35:50Z")
4 Isn't possible without a restart of the service, so check your logs for
that. Maybe the server rebooted?
5 Nope! You could just output to a file and get logstash to read them,
that'd be easiest.
6 You can, but after a while this can make an index difficult to navigate
through, so it may make sense to put them into their own indices.
7 I think you mean index, not node, see my last comment.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-QZ6edU1y-vL4BOEpMcLF\_AJwkBN%2B1a%2BJktTqd8Fxu8w%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-QZ6edU1y-vL4BOEpMcLF_AJwkBN%2B1a%2BJktTqd8Fxu8w%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@tara\_Gowda](https://discuss.elastic.co/u/tara_Gowda)
#### Post date: [March 4, 2015, 2:51am UTC](https://discuss.elastic.co/t/best-approach/22466/4 "2015-03-04T02:51:52Z")
Hi Sir,
thanks for your reply. my aim to get capture console ==\> logstatsh
=\> elasticsearch. Is there anyway i can avoid writing to file and
retrieving them, rather i would logs to direct to logstash.
also thanks for pointing diff between nodes and indices, i would have been
ignorant of this had it not for this post.
Thanks
Tara
On Monday, March 2, 2015 at 11:36:19 PM UTC-5, Mark Walkom wrote:
> 4 Isn't possible without a restart of the service, so check your logs for
> that. Maybe the server rebooted?
> 5 Nope! You could just output to a file and get logstash to read them,
> that'd be easiest.
> 6 You can, but after a while this can make an index difficult to navigate
> through, so it may make sense to put them into their own indices.
> 7 I think you mean index, not node, see my last comment.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 4, 2015, 10:15pm UTC](https://discuss.elastic.co/t/best-approach/22466/5 "2015-03-04T22:15:41Z")
It might be better if you ask that on the Logstash list -
[https://groups.google.com/forum/?hl=en-GB#!forum/logstash-users](https://groups.google.com/forum/?hl=en-GB#!forum/logstash-users)
On 4 March 2015 at 13:51, tara Gowda [ravichandragowda@gmail.com](mailto:ravichandragowda@gmail.com) wrote:
> Hi Sir,
> thanks for your reply. my aim to get capture console ==\>
> logstatsh =\> elasticsearch. Is there anyway i can avoid writing to file and
> retrieving them, rather i would logs to direct to logstash.
>
> also thanks for pointing diff between nodes and indices, i would have been
> ignorant of this had it not for this post.
>
> Thanks
> Tara
>
> On Monday, March 2, 2015 at 11:36:19 PM UTC-5, Mark Walkom wrote:
>
> > 4 Isn't possible without a restart of the service, so check your logs for
> > that. Maybe the server rebooted?
> > 5 Nope! You could just output to a file and get logstash to read them,
> > that'd be easiest.
> > 6 You can, but after a while this can make an index difficult to navigate
> > through, so it may make sense to put them into their own indices.
> > 7 I think you mean index, not node, see my last comment.
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-qkb0zWqMtNE7ewycerda-8oUwx5ZsqpnUEHGtzDB\_8Q%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-qkb0zWqMtNE7ewycerda-8oUwx5ZsqpnUEHGtzDB_8Q%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@tara\_Gowda](https://discuss.elastic.co/u/tara_Gowda)
#### Post date: [March 5, 2015, 1:31am UTC](https://discuss.elastic.co/t/best-approach/22466/6 "2015-03-05T01:31:57Z")
Thanks for your reply
On Wednesday, March 4, 2015 at 5:16:09 PM UTC-5, Mark Walkom wrote:
> It might be better if you ask that on the Logstash list -
> [Redirecting to Google Groups](https://groups.google.com/forum/?hl=en-GB#!forum/logstash-users)
>
> On 4 March 2015 at 13:51, tara Gowda \<[ravichan...@gmail.com](mailto:ravichan...@gmail.com) \\>
> wrote:
>
> > Hi Sir,
> > thanks for your reply. my aim to get capture console ==\>
> > logstatsh =\> elasticsearch. Is there anyway i can avoid writing to file and
> > retrieving them, rather i would logs to direct to logstash.
> >
> > also thanks for pointing diff between nodes and indices, i would have
> > been ignorant of this had it not for this post.
> >
> > Thanks
> > Tara
> >
> > On Monday, March 2, 2015 at 11:36:19 PM UTC-5, Mark Walkom wrote:
> >
> > > 4 Isn't possible without a restart of the service, so check your logs
> > > for that. Maybe the server rebooted?
> > > 5 Nope! You could just output to a file and get logstash to read them,
> > > that'd be easiest.
> > > 6 You can, but after a while this can make an index difficult to
> > > navigate through, so it may make sense to put them into their own indices.
> > > 7 I think you mean index, not node, see my last comment.
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/0fbf952e-2ec3-40d0-b452-e6760c3f2c73%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/ec188046-9a5c-4646-afca-548ddf881059%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/ec188046-9a5c-4646-afca-548ddf881059%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:28am UTC](https://discuss.elastic.co/t/best-approach/22466/7 "2017-07-06T00:28:25Z")