Thank you for your time! For the performance reasons, would you suggest
creating additional nodes? I currently run it all on single node which may
be an overkill, but disk space is limited too. I also thought of sending
logs via rsyslog, but this implies those priority, severity, facility
fields which I'd have to get rid of. I guess I'll stay with logstash, I've
read logstash documentation, but could you suggest some performance tweaks
for logstash? I don't use any filter at all. Just "codec => json" specified
in input section. I don't even know if it's necessary, because the input is
already formatted as json-like string. Without codec, all json is packed
into "message" field. The jvm heap is by default set to 1 GB for logstash.
I'm going to reduce most unimportant and unnecessary logs, but still, it'll
be like 4-5 millions of logs per hour to single logstash sitting on docker
container. Is it possible to configure logstash to be really minimalistic
when it comes to parse logs?