I've recently inherited the following setup to manage:
Logstash (Collector) -> Redis -> Logstash Indexer -> Elasticsearch
I can see a number of filters on the collector instances as well as the indexers. Am I correct in thinking these filters should all be on the indexer so the collectors simply receive logs on an input and push them into Redis as an output?
Am I likely to break anything if I merge the collector filters into the indexer filters, some of which I can see is duplicated at present?