Post data to Elasticsearch best parctice

(Tal Bar Or) #1

Hi All,

I have developed system act like NAC (network access control ) , and we would like to send events to ELK and create incident report.
The system is developed in Python , because of that we have the possibility to use API to post data directly into Elasticsearch , my question would be in terms of scale and performance and eventually best practice , what would be best usage of posing events to ELK
nac server > (python api)>Elasticsearch
nac server >logstash>Elasticsearch
or other method you recommended? ,
Please advice

(Magnus B├Ąck) #2

Both approaches will work and I don't see any significant benefits with either. One upside of using Logstash as a middleman is that your application can always stream data to disk without being dependent on the availability of ES. On the hand the stack becomes more complicated.

(Tal Bar Or) #3

understood Thanks

(system) #4