I'm currently in the middle of setting up a LogStash stack for our company.
We have multiple Ruby on Rails applications running, representing various environments such as our Production, staging etc.
At the moment I have one VM running Kibana, and one VM running ElasticSearch, both of them hooked up together so they can communicate.
Now my question is, what would be the recommended approach for getting the log files into ElasticSearch?
- One centralized LogStash instance on the Kibana Box, and all environments forward their logfiles to it using FileBeat?
- One LogStash installation per server, collecting the required logs and sending them directly to our ElasticSearch
Right now I can see both system works, with both systems having their own advantages and disadvantages. But I was wondering if there's like an "agreed" way of dealing with this problem.