Logstash at Tenant end or server end?

Elastic Stack Elasticsearch
1

I’m trying to design an architecture where multiple tenants ingest their logs into Elastic.

My understanding is that if the requirement is primarily log collection, I can use Elastic Agent, and if additional enrichment, filtering, or routing to multiple destinations is required, I can introduce Logstash.

What I’m trying to understand is where Logstash should be deployed in a multi-tenant/MSSP architecture — on the customer side or centrally on the server/MSSP side.

For example, if I have 10 customers and Logstash needs to be deployed on the customer side, each customer would need to install and configure their own Logstash instance. If Logstash is deployed centrally, I could potentially have a shared Logstash cluster handling ingestion from all 10 customers.

I’d like to understand which architecture is generally recommended and what factors would determine whether Logstash should be deployed at the customer end versus centrally.

2

There is no recommendation as this depends on your and your customer requirements regarding infrastructure.

For example, some customers may prefer to have a single exit machine for any reason, so in this case it may make more sense to have a logstash locally deployed.

I would say that in theory it would be better to have Logstash deployed centrally on your side as you would have more control over it, but you could also have logstash deployed on the customer side and have access to the logstash machine in the same way.

Having it on your side you need to build your infra in a way that a noisy customer would not impact other customers.

A couple of years ago I've worked on a security consulting company and we had both models of deployment, a centralized ingestion endpoint and some logstash collectors deployed locally.

How are you planning to design it on Elasticsearch side? Will you have a single elastic cluster? How are you planning to separate the data from each client?