but regardless of that question is should I use one data node or one co-ordinating master.
cluster has five data node, three master and two co-ordinating master.
I was using all data node in logstash config file.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.