# Post data to Elasticsearch best parctice

**URL:** <https://discuss.elastic.co/t/post-data-to-elasticsearch-best-parctice/41137>\
**Category:** Elasticsearch\
**Created:** [February 7, 2016, 12:51pm UTC](https://discuss.elastic.co/t/post-data-to-elasticsearch-best-parctice/41137 "2016-02-07T12:51:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tal\_Bar\_Or](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tal_bar_or/32/5127_2.png) [@Tal\_Bar\_Or](https://discuss.elastic.co/u/Tal_Bar_Or)\
**Post date:** [February 7, 2016, 12:51pm UTC](https://discuss.elastic.co/t/post-data-to-elasticsearch-best-parctice/41137/1 "2016-02-07T12:51:48Z")

</div>

Hi All,

I have developed system act like NAC (network access control ) , and we would like to send events to ELK and create incident report.  
The system is developed in Python , because of that we have the possibility to use API to post data directly into Elasticsearch , my question would be in terms of scale and performance and eventually best practice , what would be best usage of posing events to ELK  
nac server \> (python api)\>Elasticsearch  
or  
nac server \>logstash\>Elasticsearch  
or other method you recommended? ,  
Please advice  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2016, 2:24pm UTC](https://discuss.elastic.co/t/post-data-to-elasticsearch-best-parctice/41137/2 "2016-02-07T14:24:06Z")

</div>

Both approaches will work and I don't see any significant benefits with either. One upside of using Logstash as a middleman is that your application can always stream data to disk without being dependent on the availability of ES. On the hand the stack becomes more complicated.

---

<div class="post-metadata">

**Author:** ![Tal\_Bar\_Or](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tal_bar_or/32/5127_2.png) [@Tal\_Bar\_Or](https://discuss.elastic.co/u/Tal_Bar_Or)\
**Post date:** [February 7, 2016, 8:33pm UTC](https://discuss.elastic.co/t/post-data-to-elasticsearch-best-parctice/41137/3 "2016-02-07T20:33:44Z")

</div>

understood Thanks  
Cheers

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:18pm UTC](https://discuss.elastic.co/t/post-data-to-elasticsearch-best-parctice/41137/4 "2017-07-05T23:18:19Z")

</div>


