What is the best practice for multiple table? Multiple logstash config or single config?

Elastic Stack Logstash
1

Hi,
I just learned ELK and I'm confused about this use case for its Logstash implementation for a project that has quite a bad DB design...

So I have index in Elasticsearch called book. Inside it, there's a short information about it's bookshelf which has information about it's tag and type. The index is like this

{
    "id": 12345,
    "title": "Wee Woo",
    "publisher": "asdasda",
    ...
    "bookshelf": {
        "id": 45,
        "type": {
            "id" : 12,
            "name": "hardcover",
            "color_code": "blue"
        },
        "tag": {
            "id": 23,
            "name": "historical"
        }
    }
}

The bookshelf object is taken from table "bookshelf", "bookshelf_type", "bookshelf_to_tag", and "bookshelf_tag" (can't change the table).

My question is, which one would be the best practice, given that each app has the same resource and capability, and point to that one book index?
a. 1 Logstash app that joins all table
b. 2 Logstash app (1 joins bookshelf and bookshelf_tag & 1 joins bookshelf and bookshelf_type)
c. 3 Logstash app

Thanks a lot

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.