# Using Unicast discovery with logstash & elasticsearch
**URL:** https://discuss.elastic.co/t/using-unicast-discovery-with-logstash-elasticsearch/28897
**Category:** Logstash
**Created:** [September 9, 2015, 6:15am UTC](https://discuss.elastic.co/t/using-unicast-discovery-with-logstash-elasticsearch/28897 "2015-09-09T06:15:33Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Deb](https://discuss.elastic.co/u/Deb)
#### Post date: [September 9, 2015, 6:15am UTC](https://discuss.elastic.co/t/using-unicast-discovery-with-logstash-elasticsearch/28897/1 "2015-09-09T06:15:33Z")
I want to use unicast discovery in one of my logstash deployments as mentioned [here](https://www.elastic.co/guide/en/elasticsearch/guide/current/_important_configuration_changes.html#_prefer_unicast_over_multicast) in the best practices. I have gone through this [link](https://groups.google.com/forum/#!topic/logstash-users/i0D82DUfU7A).
My ES Cluster looks like below:-
- 3 Master-Data Nodes - `es-masterdata1`, `es-masterdata2`, `es-masterdata3`.
- 1 Dedicated Client Node for now - `es-client1`
I have added unicast host names in `elasticsearch.yaml` (as below) in all 3 Master data nodes:-
```
discovery.zen.ping.unicast.hosts: ["es-masterdata1:9300", "es-masterdata2:9300", "es-masterdata3:9300"]
```
I am having the following doubts:-
**Doubt 1**
Do I have to include `es-client1` in the list of unicast hosts?
```
discovery.zen.ping.unicast.hosts: ["es-masterdata1:9300", "es-masterdata2:9300", "es-masterdata3:9300", "es-client1:9300"]
```
**Doubt 2**
Do I have to include `discovery.zen.ping.unicast.hosts` in the `elasticsearch.yaml` of the `es-client1` as well?
**Doubt3**
How the logstash config should look like? Do I have to include `es-client1` as the host name or I have to give the IP of one of the master / data nodes? Which is the best practice? Is the below logstash output config fine?
```
output {
elasticsearch {
cluster => "elasticsearch"
host => "es-client1"
port => "9300"
protocol => "transport"
}
}
```
As per my understanding after reading the docs the answer to Doubt 1 & Doubt 2 is No. I wanted to confirm that.
But I could find any proper guideline regarding my 3rd doubt.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 9, 2015, 6:26am UTC](https://discuss.elastic.co/t/using-unicast-discovery-with-logstash-elasticsearch/28897/2 "2015-09-09T06:26:05Z")
> Do I have to include es-client1 in the list of unicast hosts?
No, not if es-client1 is able to connect to the cluster.
> Do I have to include discovery.zen.ping.unicast.hosts in the elasticsearch.yaml of the es-client1 as well?
Yes. How would it otherwise find the rest of the cluster members with multicast disabled?
---
### Author:  [@Deb](https://discuss.elastic.co/u/Deb)
#### Post date: [September 10, 2015, 6:11pm UTC](https://discuss.elastic.co/t/using-unicast-discovery-with-logstash-elasticsearch/28897/3 "2015-09-10T18:11:31Z")
Thanks @magnusbaeck.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/using-unicast-discovery-with-logstash-elasticsearch/28897/4 "2017-07-06T05:29:29Z")