I have a docker swarm cluster setup with the following config:
1 Coordinating node
3 Master nodes
3 Data nodes
7 Logstash nodes each extracting data from a DB
The performance however is pretty bad at the moment. I am getting an average of 2 seconds event if there is no result.
I turned off logstash hoping to see better performance and no luck. Any tips to tweak the performance?
I am running on a single node and that performs much better. Should I look to running it on bare metal instead of docker?
Additionally, elastic forces me into adding an ingest node. Why? I have added node.ingest: true to the data nodes. Can someone explain? Is this optimal? Per documentation this is a lightweight logstash feature built into elasticsearch.