Configuring Elasticsearch output in filebeat

Elastic Stack Elasticsearch
1

Currently we are using Elasticsearch 6.7.1 and have:
3 master nodes and 4 data nodes.

In filebeat configuration, should the output to elasticsearch point to master or the data nodes?
We also have a load balancer for the data nodes, so can the output in filebeat get configured to send the load balancer instead of data nodes?

2

pointing to the data nodes sounds good to me, so the master nodes do not have to deal with data but can focus on the management tasks.

1 Like
3

How about the load balancer, if we have that in front of the data nodes, should the output in filebeat get configured to send the data to the loadbalancer instead?

4

That sounds ok as well. I'd just try to reduce the number of components involved, but that is more of a personal preference.

One thing worth testing would be, what happens when an ES node is not reachable, but you only connect to the load balancer. I suppose that there is some backoff waitiing time before reconnecting, where as with a list of nodes, the next host would be tried.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.