# Logstash and sniffing

**URL:** <https://discuss.elastic.co/t/logstash-and-sniffing/199131>\
**Category:** Logstash\
**Created:** [September 11, 2019, 7:43pm UTC](https://discuss.elastic.co/t/logstash-and-sniffing/199131 "2019-09-11T19:43:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![djtecha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djtecha/32/54011_2.png) [@djtecha](https://discuss.elastic.co/u/djtecha)\
**Post date:** [September 11, 2019, 7:43pm UTC](https://discuss.elastic.co/t/logstash-and-sniffing/199131/1 "2019-09-11T19:43:45Z")

</div>

I have a question and wondering if anyone could help out. Using the sniffing protocol in Logstash do the logstash nodes know where to directly send the payload? Say I have an index on 5 of my 10 nodes and that payload has to land on one of those to get indexed. Is it smart enough to send to those nodes or does it just load balance to anyone and let the ES process decide if it should route it to the correct node?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2019, 7:43pm UTC](https://discuss.elastic.co/t/logstash-and-sniffing/199131/2 "2019-10-09T19:43:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.