we have a 5 nodes elasticsearch cluster running 5.2.0,
2 of the nodes are configured as client nodes (data=false, master=false),
3 nodes are elasticsearch cluster (data=true, master=true)
We want to install also logstash
What is the best practice for this topology?
Install the logstash at the 2 client nodes?
Install the logstash in new client server? - if so, what will happen if the node will fall? no logs will be written to elasticsearch?