when ingesting data to an elasticsearch cluster does it bring any advantage configuring logstash to use a client node for load balancing traffic instead of adding the cluster data nodes directly to the output configuration?
It means you only need to configure LS to talk to localhost, which makes it simple to maintain.
Actually I dont think it gets simpler as it is an additional component to maintain and monitor in between logstash and elasticsearch, and another potential single point of failure, but I was wondering if on the other hand it would make indexing faster, and if it would add buffering
We are running a client node already with Kibana for load balancing searches to the cluster and we had issues when the cluster is running under heavy load. In such cases the client node will freeze, and kibana will timeout trying to connect to the cluster, when the cluster is back to normal kibana wont be able to connect back because of the client node being irresponsive, only a restart of the client node will make the cluster available for kibana to search again
If the same happens to a client node used by logstash I can imagine that a lot of data could be lost
Something else is happening then, client nodes will not "freeze".
No, because LS puts back pressure back through the pipeline.