Run multiple logstash instances vs. one instance?

Elastic Stack Logstash
1

Hi All,

I have the following Logstash config

input {	
	# Receive logs
       tcp {
		port => 5544
		type => "iis"
	} 

	tcp {
		port => 5545
		type => "perfmon"
	} 
}
filter {}

output {
       if [type] == "iis" {
	elasticsearch {
		hosts => ["192.168.1.10:9200"]
		index => "iis-%{+YYYY.MM.dd}"
	}

       if [type] == "perfmon" {
	elasticsearch {
		hosts => ["192.168.1.10:9200"]
		index => "perfmon-%{+YYYY.MM.dd}"
	}
}

My question is that will using if to check types and route data to different indexes significantly affect throughput?
Should I instead run 2 Logstash instances -one listens on 5544 for iis, and the other listens on 5545 for perfmon?

2

What sort of rates are you expecting to be processing?

3

Hi Mark,

At least 5000 messages per second.

4

You should be able to handle that with a single instance.

5

Thanks, I'll try with one instance.