Elasticsearch output hosts list

Elastic Stack Logstash
#1

Hi,

Should I include all Elasticsearch nodes (there are no dedicated masters, and there's one coordinating node) when I specify the list of ES nodes in the output block? I mean in case, I'm horizontally scaling, do I need to update all pipelines on every Logstash node?
I mean I see that this surely isn't something that'd block anything since I'm not doing it, but maybe there's overhead due to that?

Thank you!

#2

Can you use a DNS CNAME that has all the hosts attached to it?

#3

Sorry, I'm not sure how that would be done. I'm not that well versed with DNS.
Anyway, I don't think that's doable for my case.

Your answer implies a 'yes, you should always append the list', otherwise, your performance will degrade. Am I right?

#4

It depends. If you are talking about hundreds of thousands of events per second, sure. If you're talking about scaling to store data for longer periods, no.

#5

There are tens of thousands of events in the LS cluster (for now), ES scaling is somewhat rare, but I like my cluster optimized :slight_smile:

Thanks for your answers!