# Elasticsearch logstash output plugin production configuration

**URL:** https://discuss.elastic.co/t/elasticsearch-logstash-output-plugin-production-configuration/43969
**Category:** Logstash
**Created:** [March 10, 2016, 1:37am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-output-plugin-production-configuration/43969 "2016-03-10T01:37:08Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![gaurav1424](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)
#### Post date: [March 10, 2016, 1:37am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-output-plugin-production-configuration/43969/1 "2016-03-10T01:37:08Z")

</div>

Hello All,

I have prototype working for me with Devices sending syslogs and then logstash parsing it and putting into elasticsearch.

In my logstash config file I have this :

elasticsearch {  
hosts =\> ["hostIP:9200"]  
}

I only have one node elastic search cluster.

Now Question is :

I will be productizing this solution. For simplicity assume that I have one Cluster and I have right now 5 nodes inside that cluster.  
SO I know I can give array of 5 nodes IP / Hostname in elasticsearch output plugin and then it will round robin to distribute data. How can I avoid putting all my node IP / hostnames into logstash config file. As system goes into production I dont want to manually go into each logstash instance and update these hosts.

What are the best practices one should follow in this case ?  
My requirement is :  
I want to run my ES cluster and I want to add / remove / update any number of node at any time. I need all of my logstash instances send data irrespective of changes at ES side.

Appreciate your time.

Thanks,  
Gaurav

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 10, 2016, 7:04am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-output-plugin-production-configuration/43969/2 "2016-03-10T07:04:12Z")

</div>

Route all traffic through a load balancer or use a DNS alias that points to one or more servers to use.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-output-plugin-production-configuration/43969/3 "2017-07-06T05:07:38Z")

</div>


