I am just trying to setup ELK with my windows based services. I am using log4net for my logs and want to use ELK stack for centralized log processing.
My question is what are the best practices for setting the ELK stack? To be more specific correct me for any of my understandings below
- Elastic server be a central server and would not be on my application box.
- Logstash would be central server and would not be on my application box.
- Kibana would be a central server and would not be on my application box.
- I will use filebeats on my application box to forward data to Logstash (so that logstash could massage the data)
- The overall flow would be filebeats would ship my application logs -> Logstash-> elastic search -> Kibana
On same lines is it advisable to write logs directly to elastic using loig4net appender? I think there would be latency issues and other concerns here is such an approach.