# Help with architecture **URL:** \ **Category:** Elasticsearch\ **Created:** [October 15, 2014, 7:57pm UTC](https://discuss.elastic.co/t/help-with-architecture/20271 "2014-10-15T19:57:18Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Joshua\_Toepfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshua_toepfer/32/1203_2.png) [@Joshua\_Toepfer](https://discuss.elastic.co/u/Joshua_Toepfer)\ **Post date:** [October 15, 2014, 7:57pm UTC](https://discuss.elastic.co/t/help-with-architecture/20271/1 "2014-10-15T19:57:18Z")
We have moved to a distributed Linux/Apache Tomcat environment, and the logs [apache, tomcat, applications, sys, etc] are killing me. We keep talking about centralize logging but doesn't seem like an easy task. I've been reading the docs on ELK, and I like what I see. What I'm still not seeing is the overall architecture in a distributed system. So I have a Logstash process on each of my server nodes? Then each of those nodes parse and report back to a centralized Elasticsearch engine? Is there any documentation that anyone could point me to get a better understanding? So that is question 1. The second question is that we visualized a copy of our production in our test environment. How can I keep the events separate from our production and test environments? Any help would be greatly appreciated. Thanks, Josh -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/54489f93-97e1-4db4-8254-762df46e5d0a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/54489f93-97e1-4db4-8254-762df46e5d0a%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 15, 2014, 9:14pm UTC](https://discuss.elastic.co/t/help-with-architecture/20271/2 "2014-10-15T21:14:51Z")
There's heaps of good docs; > **[Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/index.html)** > **[The Logstash Book](https://logstashbook.com/)** > > A book about Logstash. If you want separate data then keep separate stacks! You can use the one ES cluster if you want and then just use different indexes. Regards, Mark Walkom Infrastructure Engineer Campaign Monitor email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com) web: [www.campaignmonitor.com](http://www.campaignmonitor.com) On 16 October 2014 06:57, Joshua Toepfer [joshua.toepfer@gmail.com](mailto:joshua.toepfer@gmail.com) wrote: > We have moved to a distributed Linux/Apache Tomcat environment, and the > logs [apache, tomcat, applications, sys, etc] are killing me. We keep > talking about centralize logging but doesn't seem like an easy task. I've > been reading the docs on ELK, and I like what I see. What I'm still not > seeing is the overall architecture in a distributed system. So I have a > Logstash process on each of my server nodes? Then each of those nodes > parse and report back to a centralized Elasticsearch engine? Is there any > documentation that anyone could point me to get a better understanding? > > So that is question 1. The second question is that we visualized a copy > of our production in our test environment. How can I keep the events > separate from our production and test environments? > > Any help would be greatly appreciated. > > Thanks, > Josh > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/54489f93-97e1-4db4-8254-762df46e5d0a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/54489f93-97e1-4db4-8254-762df46e5d0a%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/54489f93-97e1-4db4-8254-762df46e5d0a%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/54489f93-97e1-4db4-8254-762df46e5d0a%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEM624aoyWVkF-CkNtKUoreBTGdv5rvWUJ0BAYqSf-oNvUrDqg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624aoyWVkF-CkNtKUoreBTGdv5rvWUJ0BAYqSf-oNvUrDqg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:55am UTC](https://discuss.elastic.co/t/help-with-architecture/20271/3 "2017-07-06T00:55:57Z")