# Cross datacenter cluster for logstash backend **URL:** \ **Category:** Elasticsearch\ **Created:** [November 9, 2012, 8:48pm UTC](https://discuss.elastic.co/t/cross-datacenter-cluster-for-logstash-backend/9654 "2012-11-09T20:48:25Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Paul\_C](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_c/32/2604_2.png) [@Paul\_C](https://discuss.elastic.co/u/Paul_C)\ **Post date:** [November 9, 2012, 8:48pm UTC](https://discuss.elastic.co/t/cross-datacenter-cluster-for-logstash-backend/9654/1 "2012-11-09T20:48:25Z")
Trying to work out the best way to end up with a single search portal ( Kibana ) for logtash with an elasticsearch backend. We have several datacenters and I've been asked to try and keep the cross-datacenter traffic down. This means I would like to be able to jail logstash output to a particular datacenter. Would I be able to solve this by tagging nodes per datacenter and then using index templates to specify which nodes to use to store the data ? If I can't do this I'll probably need to push back on the restriction about pushing log data between datacenters. something like this :- node.datacenter: DC1 curl -XPUT [http://localhost:9200/\_template/datacenter\_per\_index](http://localhost:9200/_template/datacenter_per_index) -d ' { "template" : "DC1\_logstash\*", "settings" : { "index.routing.allocation.include.datacenter" : "DC1" } }' then I can just tell logstash at each location to output to index 'DC1\_logstash-%{+YYYY.MM.dd}' and make Kibana aware of each of the index prefixes. -- ---
**Author:** ![radu\_gheorghe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radu_gheorghe/32/556_2.png) [@radu\_gheorghe](https://discuss.elastic.co/u/radu_gheorghe)\ **Post date:** [November 10, 2012, 9:59am UTC](https://discuss.elastic.co/t/cross-datacenter-cluster-for-logstash-backend/9654/2 "2012-11-10T09:59:30Z")
Hello Paul, Yep, index shard allocation should solve the problem on the ES side. And in Kibana you seem to be able to provide more index patterns, so it should work as well. But if you encounter any issues you can always post here 🙂 ## Best regards, Radu [http://sematext.com/](http://sematext.com/) -- Elasticsearch -- Solr -- Lucene On Fri, Nov 9, 2012 at 10:48 PM, Paul C [username.taken@gmail.com](mailto:username.taken@gmail.com) wrote: > Trying to work out the best way to end up with a single search portal ( > Kibana ) for logtash with an elasticsearch backend. We have several > datacenters and I've been asked to try and keep the cross-datacenter traffic > down. This means I would like to be able to jail logstash output to a > particular datacenter. Would I be able to solve this by tagging > nodes per datacenter and then using index templates to specify which nodes > to use to store the data ? If I can't do this I'll probably need to push > back on the restriction about pushing log data between datacenters. > > something like this :- > > node.datacenter: DC1 > > curl -XPUT [http://localhost:9200/\_template/datacenter\_per\_index](http://localhost:9200/_template/datacenter_per_index) -d ' > { > "template" : "DC1\_logstash\*", > "settings" : { > "index.routing.allocation.include.datacenter" : "DC1" > } > }' > > then I can just tell logstash at each location to output to index > 'DC1\_logstash-%{+YYYY.MM.dd}' and make Kibana aware of each of the index > prefixes. > > -- -- ---
**Author:** ![Zachary\_Buckholz](https://avatars.discourse-cdn.com/v4/letter/z/f1d935/32.png) [@Zachary\_Buckholz](https://discuss.elastic.co/u/Zachary_Buckholz)\ **Post date:** [October 5, 2013, 1:38pm UTC](https://discuss.elastic.co/t/cross-datacenter-cluster-for-logstash-backend/9654/3 "2013-10-05T13:38:26Z")
On Friday, November 9, 2012 1:48:25 PM UTC-7, Paul C wrote: > Trying to work out the best way to end up with a single search portal ( > Kibana ) for logtash with an elasticsearch backend. We have several > datacenters and I've been asked to try and keep the cross-datacenter > traffic down. This means I would like to be able to jail logstash output > to a particular datacenter. Would I be able to solve this by > tagging nodes per datacenter and then using index templates to specify > which nodes to use to store the data ? If I can't do this I'll probably > need to push back on the restriction about pushing log data between > datacenters. > > something like this :- > > node.datacenter: DC1 > > curl -XPUT [http://localhost:9200/\_template/datacenter\_per\_index](http://localhost:9200/_template/datacenter_per_index) -d ' > { > "template" : "DC1\_logstash\*", > "settings" : { > "index.routing.allocation.include.datacenter" : "DC1" > } > }' > > then I can just tell logstash at each location to output to index > 'DC1\_logstash-%{+YYYY.MM.dd}' and make Kibana aware of each of the index > prefixes. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:13am UTC](https://discuss.elastic.co/t/cross-datacenter-cluster-for-logstash-backend/9654/4 "2017-07-06T02:13:36Z")