I have a 16GB machine solely dedicated for running logstash. I will be using the http input.
I will have different sources whose data will be stored in different indices.
I have a choice of running separate pipelines for each source with http input configured at different port numbers.
Or I can run a single pipeline. I can direct the events to different indices based on their source. I do not mind a slight complexity in a single pipleline.
However what matters is performance. Any recommendations?
Will running a single http server port that all http clients can connect to will be better?