# Questions re Sniffing in Logstash elasticsearch output **URL:** \ **Category:** Logstash\ **Created:** [April 8, 2021, 5:47pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631 "2021-04-08T17:47:27Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\ **Post date:** [April 8, 2021, 5:47pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631/1 "2021-04-08T17:47:27Z")
I'm testing Logstash sniffing in our environment for the Elasticsearch output. So far, it appears to resolve a few issues I've had, but I've got a few questions: 1. `sniffing => true` in my elasticsearch output appears to return all elasticsearch nodes in my cluster. I use dedicated ingest nodes. When Logstash is choosing a node to send output to, does it only choose from among the ingest nodes? If not, is there a setting I can include in `sniffing_path` to force it to only return ingest nodes? 2. How frequently does Logstash do an "update" sniff, to update the list of nodes? Or do I have to restart Logstash after adding/removing nodes to/from my cluster? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2021, 6:01pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631/2 "2021-04-08T18:01:40Z")
> [@DougR](#): > > How frequently does Logstash do an "update" sniff, to see whether new nodes have been added to the cluster? The default for the sniffing\_delay option on the output is documented as 5 seconds, but looking at the [code](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/b9c66b5bfafd1ccb751afadafba829c5692f9374/lib/logstash/outputs/elasticsearch/http_client/pool.rb#L46) it appears to be 10. Down at line 152 you can see it just sits in a loop sniffing and then delaying. Looking at the sniffing [code](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/b9c66b5bfafd1ccb751afadafba829c5692f9374/lib/logstash/outputs/elasticsearch/http_client/pool.rb#L201) it skips "master" nodes and includes everything else. ---
**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\ **Post date:** [April 8, 2021, 6:37pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631/3 "2021-04-08T18:37:12Z")
> [@Badger](#): > > The default for the sniffing\_delay option on the output is documented as 5 seconds, but looking at the [code](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/b9c66b5bfafd1ccb751afadafba829c5692f9374/lib/logstash/outputs/elasticsearch/http_client/pool.rb#L46) it appears to be 10. Down at line 152 you can see it just sits in a loop sniffing and then delaying. I saw that, but couldn't determine from the documentation whether it sniffed every 5s, or that was just a "sniff again in 5s if you don't get a response." > [@Badger](#): > > Looking at the sniffing [code](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/b9c66b5bfafd1ccb751afadafba829c5692f9374/lib/logstash/outputs/elasticsearch/http_client/pool.rb#L201) it skips "master" nodes and includes everything else. Thanks for pointing me there. Unfortunately, that's a bummer, as I use dedicated ingest nodes. However, I'm not seeing errors so far. I know that the `sniffer_path` allows me to set a specific endpoint including, presumably, parameters, if accepted. Unfortunately, the documentation for the [node info API in Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-nodes-info.html) makes it appear that this is not possible. And while `_nodes/_master/http` will return master node info, there doesn't appear to be a corresponding `_nodes/_ingest/http` to return ingest node info. Is there anything you may be aware of that I'm missing? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2021, 6:59pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631/4 "2021-04-08T18:59:47Z")
> [@DougR](#): > > Is there anything you may be aware of that I'm missing? No, but I have not run elasticsearch for years, and when I did all my nodes were the same, so it is not something I know a lot about. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 6, 2021, 7:02pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631/6 "2021-05-06T19:02:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.