Connecting Logstash to Elastic Master or Elastic Data


When having a Elastic Master servers and Elastic Data servers, should the Logstash consumer point to the Elastic Data for the output or the Elastic Master? What is the difference between the two connections/outputs and which one is recommended?

If you have dedicated master nodes in the cluster these should be left to manage the cluster and you should point Logstash to just the data nodes. The whole point of having dedicated mater nodes is to avoid them getting overloaded or have a lot of GC, and the best way to do this is to not send requests to them.