# ELK gathering logs from all Azure regions - is it possible?

**URL:** <https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983>\
**Category:** Elasticsearch\
**Created:** [October 14, 2017, 11:02am UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983 "2017-10-14T11:02:08Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [October 14, 2017, 11:02am UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983/1 "2017-10-14T11:02:08Z")

</div>

Hi all,

we are thinking of deploying ELK stack for our cloud only based company (azure). We are in several Azure regions and would like to have a look at all logs from all these regions. Because in Azure there is no peering between regions I wonder what is your approach to get all the logs into ELK (we don't have on-premise servers):

- install ELK in every region ?
- install one ELK in one region + create VPN between Azure regions ?
- anything else ?

Thank you  
P.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 14, 2017, 2:49pm UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983/2 "2017-10-14T14:49:58Z")

</div>

FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out 😉

The options you have described are all valid. You can use things like cross cluster search to federate views across multiple clusters, or ship everything to one.

it really depends on your ultimate requirements.

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [October 14, 2017, 10:18pm UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983/3 "2017-10-14T22:18:56Z")

</div>

Hi @warkolm,

thanks for your feedback.  
What are pros and cons of each solution ?

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [November 2, 2017, 10:18am UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983/4 "2017-11-02T10:18:32Z")

</div>

Which solution from the above options do you recommend to:

- be the most friendly from management point of view
- be cost friendly

What do you usually choose when dealing with logs generated in multiple regions ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 2, 2017, 8:08pm UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983/5 "2017-11-02T20:08:19Z")

</div>

What is a management point of view?  
How do you define cost friendly? I don't know your infrastructure, those costs or your budget so I can't comment there.

---

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [November 2, 2017, 9:14pm UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983/6 "2017-11-02T21:14:59Z")

</div>

Fair enough.  
By management point of view I mean to not spend too much time maintaining it. We are small team and we cannot dedicate anyone just to maintain ELK. So ideally we should have one ELK stack for everything. But it may generate additional cost because when you ship logs across cloud regions you pay for it. So I am looking for some balance between maintenance and cost.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 2, 2017, 9:16pm UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983/7 "2017-11-02T21:16:08Z")

</div>

Ok. Then that really feeds back into the same points.

Don't mean to ignore them, but you are best placed to test and make that decision. You can always use Elastic Cloud to host Elasticsearch and Kibana, reducing your operational overheads 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2017, 9:16pm UTC](https://discuss.elastic.co/t/elk-gathering-logs-from-all-azure-regions-is-it-possible/103983/8 "2017-11-30T21:16:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
