One filebeat server for multiple logs server

I have an architecture choice to do. Very strategic.
I have 200 hundred log servers.

choice #1 : i install filebeat on every 200 servers
choice #2 : i install filebeat on a windows 'central' server and i write multiple propectors with a distant server path (- \server1\d$..., -\server2\d$..., etc...)

what is the best choice ?
choice #1 is very 'heavy' on installations
choice #2 is better with only one installation, easier for version upgrade and so on ...

ty very much for your answer :slight_smile:

I recommend choice 1 - installing Filebeat on each node that produces logs.

If you use a CM tool like Ansible, Puppet, or the like, then deploying and upgrading shouldn't be much work.

ty very much andrew for your answer :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.