# Should I send the logs from logstash hosts to data nodes or master nodes?

**URL:** <https://discuss.elastic.co/t/should-i-send-the-logs-from-logstash-hosts-to-data-nodes-or-master-nodes/71420>\
**Category:** Elasticsearch\
**Created:** [January 12, 2017, 6:27pm UTC](https://discuss.elastic.co/t/should-i-send-the-logs-from-logstash-hosts-to-data-nodes-or-master-nodes/71420 "2017-01-12T18:27:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nanshan](https://avatars.discourse-cdn.com/v4/letter/n/858c86/32.png) [@nanshan](https://discuss.elastic.co/u/nanshan)\
**Post date:** [January 12, 2017, 6:27pm UTC](https://discuss.elastic.co/t/should-i-send-the-logs-from-logstash-hosts-to-data-nodes-or-master-nodes/71420/1 "2017-01-12T18:27:13Z")

</div>

which node for storing the logs?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 12, 2017, 7:34pm UTC](https://discuss.elastic.co/t/should-i-send-the-logs-from-logstash-hosts-to-data-nodes-or-master-nodes/71420/2 "2017-01-12T19:34:51Z")

</div>

Quoting the [docs for Logstash's elasticsearch output](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-hosts):

> It is important to exclude dedicated master nodes from the hosts list to prevent LS from sending bulk requests to the master nodes. So this parameter should only reference either data or client nodes in Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2017, 7:35pm UTC](https://discuss.elastic.co/t/should-i-send-the-logs-from-logstash-hosts-to-data-nodes-or-master-nodes/71420/3 "2017-02-09T19:35:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
