I have possible a dumb question... :-). We have 4 logstash servers running and are configured to receive syslog messages. But, the catch is that apparently logstash doesn't send the logs directly (parsed) to elasticsearch, but instead keeps them on the disk, causing off course the disk filling up.
This: https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/configuring-destinations-elasticsearch.html... Is not a option, because of the different types (Solaris, Linux,...) Servers that are sending their logs to logstash.
So is there a way that the logs get to logstash, getting parsed and are send directly (like all the other logs) to elasticsearch?