We are developing a distributed, docker-based server-application. We run several docker-containers on each host. The idea is to put a logstash-instance (as a docker-container) on each host which publishes to a single elasticsearch-cluster. A kibana frontend should sit on top ot the elasticsearch cluster. Since I am new to logstash and elasticsearch, I have some questions:
1.) Is this setup possible?
2.) Is this setup "good practice"?
3.) Can I monitor my logs on the kibana-frontend in the same way as if I use a single logstash instance or do I have to partition the database in some way?
Thanks in advance for any reply.