If I have a es cluster which has three data nodes (B,C,D) and a master node (A). Now I want to use filebeat to collect logs and directly transfer date to the es cluster.Which node should I transfer the data to？
Great Question you can configure filebeat to send data to your data / ingest / coordinating nodes since that is where the most traffic will go.... Master Nodes only keep track of the state of the cluster they do not write data
I will comment your cluster would be more resilient if you just left your 3 data nodes as data + master nodes... rather than just having a single dedicated master node (if it fails your cluster will fail). 3 Data + Master Nodes is a very common and resilient initial cluster design.
But I still have a question. If I have 12 filebeats (F1, ...,F12),and I have three data nodes (B,C,D).
The best allocation strategy is to transfer the data of 12 filebeans to 3 data nodes on average？