# How to forward logstash output to ES cluster and not to one host

**URL:** https://discuss.elastic.co/t/how-to-forward-logstash-output-to-es-cluster-and-not-to-one-host/153816
**Category:** Logstash
**Created:** [October 24, 2018, 1:43pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-output-to-es-cluster-and-not-to-one-host/153816 "2018-10-24T13:43:42Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Parvatayya\_Malimath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parvatayya_malimath/32/49330_2.png) [@Parvatayya\_Malimath](https://discuss.elastic.co/u/Parvatayya_Malimath)
#### Post date: [October 24, 2018, 1:43pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-output-to-es-cluster-and-not-to-one-host/153816/1 "2018-10-24T13:43:42Z")

</div>

Hi

I have to collect logs from around 20 servers(micro services are running there ), I have 3 elasticserach hosts, which are running in cluster formation. (2 masters and 1 data ). now when i trying to forward logs from logstatsh I do like below.

output {  
elasticsearch { hosts =\> ["[http://elasticsearchmaster](http://elasticsearchmaster):port"] }  
}

but by doing above , i am only forwarding to one host, how do I forward the logs to cluster? please help.

output {  
elasticsearch { hosts =\> ["[http://jackson.cc.cec.eu.int:32406](http://jackson.cc.cec.eu.int:32406)"] }  
}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 24, 2018, 8:59pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-output-to-es-cluster-and-not-to-one-host/153816/2 "2018-10-24T20:59:37Z")

</div>

> I have 3 elasticserach hosts, which are running in cluster formation. (2 masters and 1 data )

Off topic, but that doesn't sound like a good idea.

> but by doing above , i am only forwarding to one host, how do I forward the logs to cluster?

The `hosts` option is an array so you can list multiple URLs there. You can also enable the `sniffing` option so that Logstash asks the cluster which nodes are available. That way Logstash will loadbalance requests to all currently eligible cluster nodes.

---

<div class="post-metadata">

### Author: ![Parvatayya\_Malimath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parvatayya_malimath/32/49330_2.png) [@Parvatayya\_Malimath](https://discuss.elastic.co/u/Parvatayya_Malimath)
#### Post date: [October 25, 2018, 6:56am UTC](https://discuss.elastic.co/t/how-to-forward-logstash-output-to-es-cluster-and-not-to-one-host/153816/3 "2018-10-25T06:56:00Z")

</div>

> [@magnusbaeck](#):
>
> Off topic, but that doesn't sound like a good idea.

Thanks a lot, i can load balance now, but can you give me a tip on why you think its not a good idea?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 26, 2018, 8:03pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-output-to-es-cluster-and-not-to-one-host/153816/4 "2018-10-26T20:03:47Z")

</div>

- You should always have an odd number of masters.
- Having multiple masters managing a single data node doesn't make much sense. The resources are probably better spent in other ways.
- Having masters receive indexing requests from Logstash is a bad idea.

---

<div class="post-metadata">

### Author: ![Parvatayya\_Malimath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parvatayya_malimath/32/49330_2.png) [@Parvatayya\_Malimath](https://discuss.elastic.co/u/Parvatayya_Malimath)
#### Post date: [October 27, 2018, 4:11am UTC](https://discuss.elastic.co/t/how-to-forward-logstash-output-to-es-cluster-and-not-to-one-host/153816/5 "2018-10-27T04:11:53Z")

</div>

It would be really helpfull if there are some guidelines on how to configure? Is there a document or something? Please help. I tried to find but no luck

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 24, 2018, 4:11am UTC](https://discuss.elastic.co/t/how-to-forward-logstash-output-to-es-cluster-and-not-to-one-host/153816/6 "2018-11-24T04:11:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
