Prevent Elasticsearch from message flood


We use Elasticsearch in our elk setup. Logstash is sending the logs via http to Elasticsearch. I wonder is there a way to protect Elasticsearch going down from unexpected high message load?


Use a broker - redis, kafkfa, MQ.
Send events to the broker and then to ES, that way they can queue up in the broker if there is an influx and you process them into ES at your own pace.