I am using pipeline that uses filebeat, kafka, logstash, and Elastic service.
kafka and logstash consist of one server.(4core, 4GB ram)
Elastic service uses one master node and three data nodes.(2core, 2GB ram)
Recently, the amount of logs collected through filebeat has increased rapidly, which seems to have caused a bottleneck in the process of being stored in the Elastic service.
Please advise whether to increase the number of servers in logstash or the number of data nodes in Elastic service.