If you have 3 data nodes in a cluster and logstash is sending data to this cluster, what happens if one of the nodes crashes with respect to the incoming logstash data? I've read lots of articles about replicas with respect to data currently in the cluster and how that recovery works if you have replicas but was curious about new data coming in if you are short a node. Does any data get written to the 2 remaining nodes or is the data help until the crashed cluster comes back up? Thanks
If you have at least one replica of each shard written to it's business as usual. If the primary shard was on the crashed node the master node will promote one of the replica shards to primary and attempt to allocate a new replica shard so that the requested replica level is maintained.
This assumes that Logstash isn't configured to send requests to just one of the nodes (and that node goes down).