I’m trying to design an architecture where multiple tenants ingest their logs into Elastic.
My understanding is that if the requirement is primarily log collection, I can use Elastic Agent, and if additional enrichment, filtering, or routing to multiple destinations is required, I can introduce Logstash.
What I’m trying to understand is where Logstash should be deployed in a multi-tenant/MSSP architecture — on the customer side or centrally on the server/MSSP side.
For example, if I have 10 customers and Logstash needs to be deployed on the customer side, each customer would need to install and configure their own Logstash instance. If Logstash is deployed centrally, I could potentially have a shared Logstash cluster handling ingestion from all 10 customers.
I’d like to understand which architecture is generally recommended and what factors would determine whether Logstash should be deployed at the customer end versus centrally.