What is better Transport protocol or http with SSL for communcation between logstash and elasticsearch?
According to the documentation at Using Logstash with Shield | Shield [2.4] | Elastic
Connecting with Transport protocol
When you set the protocol option to transport, Logstash communicates with the Elasticsearch cluster through the same protocol nodes use between each other. This avoids JSON un/marshalling and is therefore more efficient.
In order to unlock this option, it’s necessary to install an additional plugin in Logstash using the following command to also get Shield compatibility within the transport protocol:
bin/plugin install logstash-output-elasticsearch_java
bin/plugin install logstash-output-elasticsearch_java_shield
This is only necessary if you want to use the transport protocol within Logstash. However, it is recommended to use the default http protocol, which means that you do not need to install any plugins, nor do you need to use the elasticsearch_java output.
I also saw the documentation at Talking to Elasticsearch | Elasticsearch: The Definitive Guide [2.x] | Elastic