# Elk architecture

**URL:** <https://discuss.elastic.co/t/elk-architecture/164984>\
**Category:** Logstash\
**Created:** [January 21, 2019, 6:35am UTC](https://discuss.elastic.co/t/elk-architecture/164984 "2019-01-21T06:35:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Post date:** [January 21, 2019, 6:35am UTC](https://discuss.elastic.co/t/elk-architecture/164984/1 "2019-01-21T06:35:55Z")

</div>

hi all,

I want to ship different logs located in different machines into a remote machine where one node of elasticsearch installed. for this purpose, i want to install filebeat on each machine where logs are; so according to number of machines, I will install filebeat. now i want to filter logs using logstash, actually filebeat ship logs into logstash, i have a question about where logstash should be installed? which one does lead to better performance and less resource consuming?  
1- install logstash on each machine where filebeat installed and feed the filebeat output of that machine to its logstash, then all logstash tools send the logs to elasticsearch. (in this case the number of installed logstashes is same as number of installed filebeates).  
2- install just one logstash and all filebeats ship their logs into that logstash.

thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 21, 2019, 7:40am UTC](https://discuss.elastic.co/t/elk-architecture/164984/2 "2019-01-21T07:40:33Z")

</div>

> [@sahere37](#):
>
> 2- install just one logstash and all filebeats ship their logs into that logstash.

Yes, Logstash is generally used as a central processor rather than deployed on every host. You may also want to consider [using ingest node pipelines in Elasticsearch directly with Filebeat](https://www.elastic.co/blog/should-i-use-logstash-or-elasticsearch-ingest-nodes).

---

<div class="post-metadata">

**Author:** ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)\
**Post date:** [January 21, 2019, 8:06am UTC](https://discuss.elastic.co/t/elk-architecture/164984/3 "2019-01-21T08:06:12Z")

</div>

many thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 18, 2019, 8:06am UTC](https://discuss.elastic.co/t/elk-architecture/164984/4 "2019-02-18T08:06:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.