How to send logs to the ES if I have 1 master node and two data nodes? Should I send all logs to master or all to data or it doesnt matter?
(I was unable to see such information in the master/data node manual)
I also saw the logstash -> output-plugins -> ElasticSearch. It write there:
It is important to exclude dedicated master nodes from the hosts list to prevent LS from sending bulk requests to the master nodes. So this parameter should only reference either data or client nodes in Elasticsearch.
Does this mean not to send the logs to the data node?