Apologies if this is the wrong place to post these questions, or if they're laughably stupid, but I need your help. Up to now, I've been running a single-node, version 2.x, ELK stack. While we have only about 100 servers shipping logs to it, it is under a bit of strain. So, now I figure it's time set up a multi-node, version 5.x, ELK stack. My intention is to do that from scratch, rather than upgrade my current instance. The following questions (and there will probably be more)) are important to my effort, as I can't seem to find the answers anywhere else (though they may be out there). Here goes:
- What is the optimal, or perhaps minimum, number of nodes to include in my cluster (from what I've read, it seems to be three)?
- What roles should the new nodes be set up for (Master, DAta, etc.)?
- Which ELK applications live on which nodes?
- How would config files for Logstash, Elasticsearch, etc. differ between nodes?
- To which node(s) do the various servers ship their logs to?
Hope I'm not being a pita but, again, I really need the help to move forward.