I am understanding the process of indexing. I have read this question and answer:
When I use Logstash, I define the index for each document in the output.
But why should we specify the data node of Elasticsearch cluster for the output in Logstash but not specify the master node which is specialized for indexing? Or is that the indexing is already done in Logstash so we can directly send them to data node?
Should the flow be like this?:
Logstash filtering and indexing -> ES data node, or
Logstash filtering -> ES master node indexing -> ES data node for storage
Thank you in advance