Logstash or straight?


Simpel question,

What would be the (dis)advantage of sending metrics via logstash to ES instead of directly?


1 Like


Hello Eric,

I see the complexity as the biggest disadvantage of this setup: You have one more possible root of errors, more network traffic, one more application to maintain, update, ...

The question is: why would you want that?

  • If you want to post process the data yu could also use an ELasticSearch ingest pipeline.
  • If you do not want to open access from all servers to the elastic cluster you could host an ingest node which is accessible from those servers instead of a LogStash instance.

I am not saying that LogStash is bad - in fact we use it a lot - but I prefer to keep the pipeline from host to the Elastic Stack as clean and easy as possible.

Best regards

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.