I wanted to know which is better to have parsed logs backup into S3 bucket or write on local disk. Local disk is cheaper. With S3 output creates temporary files into the OS temporary directory, then will transfer the files to the S3 bucket, so is it once per day! as i understating it!
So even with S3 output we have to think about the storage capacity on the ELK server machine, since it creates temporary directory to save the files.
Which way is cheaper and safer, local buckups, S3, or Elsaticsearch snapshot?