Logstash and Kibana as coordinating nodes - Does it makes senses?

Elastic Stack Elasticsearch
1

Hello !

In the following setup, does it makes sense to configure Logstash-Central and Kibana as coordinating nodes ? :

Syslog/beats => Logstash-satellite => Kafka <= Logstash-central => Elasticsearch <= Kibana

If this is the case, can you please confirm that in Kibana/Logstash settings, I have to add all the coordinating nodes and not only local node ("https://127.0.0.1:9200")

Thanks !

2

Anybody ? :yum:

3

Yes that makes sense.

4

Thanks @warkolm. Could you explain quickly why ?

5

Co-ordinating nodes are basically load balancers into the existing cluster, they can also take away some of the load from other nodes as well (during the query parsing process), which means your data nodes have more resources.

6

OK great. So I have to point Kibana to all coordinating nodes or only only one is enough ?

7

Unless you want to run multiple instances of Kibana, just keep it to the one.

8

Just to be sure, I speak about this settings in Kibana :

The URLs of the Elasticsearch instances to use for all your queries.

elasticsearch.hosts: ["https://X.X.X.X:9200"]

So even if I have 2 or more coordinating nodes, this is not necessary to add them all in this setting ?

9

If the local Elasticsearch node is down, it's likely to be something that'll also impact Kibana (ie at the host level), so probably not.

10

Ok thank you ! :slight_smile:

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.