Multiple regions – push or pull?

Elastic Stack Logstash
1

Which way is better for one ELK cluster running for many regions:

  • Set up a Logstash instance in each region, and push the data to one Elasticsearch (“push”)?
  • Set up a queue (i.e. Redis) in each region, and use one Logstash to pull all data from all regions, then push to one Elasticsearch (“pull”)?
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.