We have a .NET Framework stack where each application instance is deployed on its own windows server.
We want to move to ELK instead of just writing log files to a shared network drive.
What would be the best solution in your opinion? Having a single (or a set number) of filebeat instances in a Linux server that read logs from the share network drive (or mount to the windows server drives)?
Or having a Filebeat for every windows server that hosts an instance of the application, and sending it to a shared Logstash?
Would the latter pose any performance concerns?