Best practices for logstash output configuration and Elasticsearch

Elastic Stack Logstash
1

Hello,

My question is related to the correct way to configure the output, for Elasticsearch.

Right now my Elasticsearch cluster is one dedicated master node, 3 data nodes and acts as master eligible nodes and 1 coordinating node.

how to configure output for elasticsearch in logstash, i would like to know best practices for the same
Any recommendations?

2

The hosts entry for the elasticsearch output can take an array of values, meaning it will automatically load balance between each of the entries you define.

Point your logstash output to the three data nodes in an array and you should be good to go.