# Dependable output in bulks to local and remote elasticsearch

**URL:** <https://discuss.elastic.co/t/dependable-output-in-bulks-to-local-and-remote-elasticsearch/88067>\
**Category:** Logstash\
**Created:** [June 2, 2017, 10:48am UTC](https://discuss.elastic.co/t/dependable-output-in-bulks-to-local-and-remote-elasticsearch/88067 "2017-06-02T10:48:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ma.Na](https://avatars.discourse-cdn.com/v4/letter/m/df705f/32.png) [@Ma.Na](https://discuss.elastic.co/u/Ma.Na)\
**Post date:** [June 2, 2017, 10:48am UTC](https://discuss.elastic.co/t/dependable-output-in-bulks-to-local-and-remote-elasticsearch/88067/1 "2017-06-02T10:48:22Z")

</div>

I am running several instances of a local [ELK Stack](https://github.com/dtag-dev-sec/tpotce). Hence, logstash imports, filters and then outputs to a local elasticsearch:

```
output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }

```

Due to space constraints, indices older than 7 days are deleted at the local elasticsearch. I want to archive the data from all local ELK Stacks at one central, remote stack. I need a solution that is dependant (deals with high network usage peaks etc), offers some kind of authentication and, as it is quite a lot of data, a transmission in aggregates of i.e. 5min, 1h.

**What is the best practice for this task?** I am not sure if I should use the 1) logstash-output plugins, 2) elasticdump 3) beats, 4) or something completely different (rsync?).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2017, 10:48am UTC](https://discuss.elastic.co/t/dependable-output-in-bulks-to-local-and-remote-elasticsearch/88067/2 "2017-06-30T10:48:36Z")

</div>

Closed on June 30, 2017, 10:48am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.