One filebeat server for multiple logs server

[ericpietro]

hello,
I have an architecture choice to do. Very strategic.
I have 200 hundred log servers.

choice #1 : i install filebeat on every 200 servers
choice #2 : i install filebeat on a windows 'central' server and i write multiple propectors with a distant server path (- \server1\d$..., -\server2\d$..., etc...)

what is the best choice ?
choice #1 is very 'heavy' on installations
choice #2 is better with only one installation, easier for version upgrade and so on ...

ty very much for your answer

[andrewkroh]

I recommend choice 1 - installing Filebeat on each node that produces logs.

• There is no single point of failure.
• You don't have to deal with a network filesystem.

If you use a CM tool like Ansible, Puppet, or the like, then deploying and upgrading shouldn't be much work.

[ericpietro]

ty very much andrew for your answer