Elasticsearch output hosts list


Should I include all Elasticsearch nodes (there are no dedicated masters, and there's one coordinating node) when I specify the list of ES nodes in the output block? I mean in case, I'm horizontally scaling, do I need to update all pipelines on every Logstash node?
I mean I see that this surely isn't something that'd block anything since I'm not doing it, but maybe there's overhead due to that?

Thank you!

Can you use a DNS CNAME that has all the hosts attached to it?

Sorry, I'm not sure how that would be done. I'm not that well versed with DNS.
Anyway, I don't think that's doable for my case.

Your answer implies a 'yes, you should always append the list', otherwise, your performance will degrade. Am I right?

It depends. If you are talking about hundreds of thousands of events per second, sure. If you're talking about scaling to store data for longer periods, no.

There are tens of thousands of events in the LS cluster (for now), ES scaling is somewhat rare, but I like my cluster optimized :slight_smile:

Thanks for your answers!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.