Multiple regions – push or pull?

Which way is better for one ELK cluster running for many regions:

  • Set up a Logstash instance in each region, and push the data to one Elasticsearch (“push”)?
  • Set up a queue (i.e. Redis) in each region, and use one Logstash to pull all data from all regions, then push to one Elasticsearch (“pull”)?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.