What if i use logstash instead of logstash forwarder/beats in my environment, and directly send the logs to elasticsearch. What will be the impact
If you really want to, there's nothing stopping you. Logstash is a bit heavy, though. You have to have a JVM and enough free memory for Logstash to run on those edge nodes.
Logstash Forwarder is fully deprecated. Don't use it. Use filebeat instead. Filebeat is derived from the old logstash forwarder code and has been considerably improved upon since then.
The other impact will be the number of client connections to Elasticsearch. Make sure the target can handle the extra load.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.