There seems to be some ambiguity in relation to the concept of a logstasher outputting to an ES cluster. There is very little mention of the concept in the logstash documentation that I could find.
The "hosts" setting in the ES output plugin allows you to specify multiple nodes which will load balance across these multiple hosts. How does that correlate to the "sniffing" setting? If I enable the sniffing setting does that mean I can specify any single cluster node in the hosts setting? Will there still be load balancing?