Best practices for on boarding ELK stack

Elastic Stack Elasticsearch
1

Hi All
I am just trying to setup ELK with my windows based services. I am using log4net for my logs and want to use ELK stack for centralized log processing.
My question is what are the best practices for setting the ELK stack? To be more specific correct me for any of my understandings below

  1. Elastic server be a central server and would not be on my application box.
  2. Logstash would be central server and would not be on my application box.
  3. Kibana would be a central server and would not be on my application box.
  4. I will use filebeats on my application box to forward data to Logstash (so that logstash could massage the data)
  5. The overall flow would be filebeats would ship my application logs -> Logstash-> elastic search -> Kibana

On same lines is it advisable to write logs directly to elastic using loig4net appender? I think there would be latency issues and other concerns here is such an approach.

2

1-3 yes ideally.
3 yes.
5 Yes.

It can be done, but you do need to be aware of things like that. Or what happens if the agent cannot connect.

3

Thanks @warkolm

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.