I am currently examining how to deploy log shipping within my server farm, and trying to understand when is it right to use Logstash on the application servers and when it is right to use Filebeat. As you can understand I have multiple application servers and a single ELK server to which I want the logs delivered.
My dilemma is between the following topologies:
- logstash(multiple) => redis -> logstash -> elasticsearch
- filebeat(multiple) => logstash -> redis -> logstash -> elasticsearch
So, some questions:
Are the any guidelines when to implement these topologies? Why not to use Logstash on each app server?
I saw some mention of the JVM, but is there any documentation as to what is the load Logstash creates on each server?
Looking at the future, with the introduction of the Beats framework, are they going to take Logstash's place in a server farm scenario?