Filebeat out put plugin

Hello everyone,
Right now i have a cluster with 4 nodes. 3x(master-data) 1x(data only).
in some scenario i am using file beat to send logs directly to elasticsearch and in some other scenario to log-stash.
my question is how should my file beat output plugin look like..should i just mentions the master-data name in output plugin??or should also mention the data only node name ??iam using filebeat load balancer also!from my perspective what i understood is the master-data node will decide where does the data stay,,am i right?
another question what is going to happen if one of the node space become 100% full???

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.