Running logstash and elasticsearch on two machine

Elastic Stack Logstash
#1

I have worked out everything on my local machine, parsed my logs in logstash, stored them in kibana, and built dashboards for my data on Kibana.
Now I trying to mock a production scenario where logstash is installed on one server and elasticsearch on another.
Currently, the only thing I did was specifying in logstash the host to be the IP address of the elasticsearch host:

and in elasticsearch.yml on the elasticsearch server, change network.host to the IP address of the logstash server.

Screen Shot 2015-07-24 at 2.42.21 PM.png641×622 114 KB

And I dont think it works, can some one tell me what other settings I need to change or point me to some guides regarding setting this up? Thanks a million in advance

#2

Add protocol => http to the ES output and try again.

#3

and in elasticsearch.yml on the elasticsearch server, change network.host to the IP address of the logstash server.

No, don't do that. The network.* settings must point to addresses held by interfaces by the machine running Elasticsearch. You don't need to do anything special to have Logstash connect to ES. Just make sure Logstash can connect to port 9300 on the ES machine (or port 9200 if you're using HTTP, which I'd recommend anyway) and that they have the same cluster name configured.

#4

Thank you!

#5

Thanks Magnus, it works now!

#6

Should I have elasticsearch and logstash on different machines when deploying the ELK stack in production (as I've read that somewhere in the internet)? or can they be installed on the same server with the following logstash output:

output{
   elasticsearch {host => "localhost"}
 }
#7

@taraka16, please start a new thread for your unrelated question.

#9