I had to make a log analyzer. My friend has created a same thing last year to analyze log using ELK stack but it take 30-40 mins for logstash processing in his project. Is there any way that I can use multiple Logstash instances to process log data and then pass it on to ElasticSearch?
So that time required will be less.
logstash is multi-threaded, so a single logstash instance should be able to consume all the resources of a single server. You can certainly distribute your logs across multiple servers to consume them faster.
How have you determined that it is Logstash that is the bottleneck and not Elasticsearch?
Yes.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.