# Does filebeat transmit data to the master node of the elasticsearch cluster or to the data node

**URL:** <https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 24, 2022, 1:54am UTC](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694 "2022-11-24T01:54:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![CatLoveFishma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/catlovefishma/32/113704_2.png) [@CatLoveFishma](https://discuss.elastic.co/u/CatLoveFishma)\
**Post date:** [November 24, 2022, 1:54am UTC](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694/1 "2022-11-24T01:54:19Z")

</div>

Hello,  
If I have a es cluster which has three data nodes (B,C,D) and a master node (A). Now I want to use filebeat to collect logs and directly transfer date to the es cluster.Which node should I transfer the data to？  
data nodes?

```auto
output.elasticsearch:
    hosts: ["dataNode.IP:9200"]

```

or  
master node?

```auto
output.elasticsearch:
    hosts: ["masterNode.IP:9200"]

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 24, 2022, 2:02am UTC](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694/2 "2022-11-24T02:02:57Z")

</div>

Hi @CatLoveFishma Welcome to the community!

Great Question you can configure filebeat to send data to your data / ingest / coordinating nodes since that is where the most traffic will go.... Master Nodes only keep track of the state of the cluster they do not write data

`hosts: ["dataNodeA.IP:9200", "dataNodeB.IP:9200", "dataNodeC.IP:9200",]`

I will comment your cluster would be more resilient if you just left your 3 data nodes as data + master nodes... rather than just having a single dedicated master node (if it fails your cluster will fail). 3 Data + Master Nodes is a very common and resilient initial cluster design.

---

<div class="post-metadata">

**Author:** ![CatLoveFishma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/catlovefishma/32/113704_2.png) [@CatLoveFishma](https://discuss.elastic.co/u/CatLoveFishma)\
**Post date:** [November 24, 2022, 6:40am UTC](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694/3 "2022-11-24T06:40:31Z")

</div>

Thank you  
But I still have a question. If I have 12 filebeats (F1, ...,F12),and I have three data nodes (B,C,D).  
The best allocation strategy is to transfer the data of 12 filebeans to 3 data nodes on average？

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 24, 2022, 8:27am UTC](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694/4 "2022-11-24T08:27:59Z")

</div>

Yes.. don't overthink it let filebeat and Elasticsearch do the work for you.

All 12 beats point to the three data notes.

When clusters grow, people often put a load balancer in front of the data nodes and then just point all the filebeats or other ingest processes to the load balancer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 22, 2022, 10:28am UTC](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694/5 "2022-12-22T10:28:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.