Hi,
Simpel question,
What would be the (dis)advantage of sending metrics via logstash to ES instead of directly?
Cheers,
nobody?
Hello Eric,
I see the complexity as the biggest disadvantage of this setup: You have one more possible root of errors, more network traffic, one more application to maintain, update, ...
The question is: why would you want that?
- If you want to post process the data yu could also use an ELasticSearch ingest pipeline.
- If you do not want to open access from all servers to the elastic cluster you could host an ingest node which is accessible from those servers instead of a LogStash instance.
I am not saying that LogStash is bad - in fact we use it a lot - but I prefer to keep the pipeline from host to the Elastic Stack as clean and easy as possible.
Best regards