I have two Elasticsearch nodes that are in two different data centres with a large geographical separation. I would like to share or consolidate the data between these two nodes.
This is a lightweight deployment with filebeat instances sending data to logstash instances within the same data center which then stores the result in the single Elasticsearch node in that data center.
The options I'm looking at are:
Connecting the two nodes to form an Elasticsearch cluster. Due the latency between the nodes in different data centers, I believe this option is advised against.
Co-locating the two nodes in one data center. I am hesitant about this option as then filebeat would need to send the data from one data center to the other data center and the variability of ACKs from logstash could affect the processing rates.
Using tribe nodes. From my understanding this would require two additional VMs. Since this is a lightweight deployment with only two Elasticsearch nodes I don't really like having to double the requirement, but if this is the proper solution it may be the best option.
What option would be best in this situation? Are there any options I may of missed?