Logstash into another different cluster?

Elastic Stack Logstash
1

Hi How could i export data from logstash to another ES cluster, which i never used before?
It is just i need to logstash the data from my local logstash to my team's ES Cluster, rather than my own test ES cluster...

I changed the cluster name already to the new cluster name in elasticsearch.yml. But my previous cluster still gets data...Anything else i shall do?
Any suggestion pls?

2

Change the Elasticsearch hostname in the elasticsearch output to one or more of the hosts in the cluster you want to send to. This has nothing to do with elasticsearch.yml.

3

i don't understand. The host is still with ES with port 9200 and host 127.0.0.1. It is just another ES cluster.

4

If the host and port are the same and you've just renamed the cluster you don't have to do anything. Logstash's elasticsearch output doesn't care about the cluster name set in elasticsearch.yml.

If you want to send to a different cluster (and not the same cluster that has been renamed) the host and/or port must change. Two ES clusters can't listen on the same host:port combination.

5

Yea it is the 2nd situation.

My solution somehow works: I only changed the cluster name in the elasticsearch yml files. It works the second day, not immediately. i haven't switched back yet, not sure if there will be problem.

For your solution, to change the port or/and host, how can i do that? I think port 9200 is a fixed value for ES, and host value should also be the same value for everyone...?

6

Let me put it this way: You should point Logstash to the host and port of one or more of your Elasticsearch nodes. Period. Logstash doesn't care about the name of the cluster.

7

How can I change the port or/and host name? Are they not fixed as 9200 and 127.0.0.1? (All clusters are ES)

8

The HTTP port that Elasticsearch listens to is controlled by the http.port configuration setting. See https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-http.html.

The hostname that ES listens to is obviously controlled by the host that it runs on, but if your server has multiple network interfaces you can select one of them if you don't want ES to be accessible on all interfaces. The default is indeed 127.0.0.1, and with that setting ES is of course not accessible from other hosts.