Whats different with "protocol node" or "protocol http" in logstash output

Elastic Stack Elasticsearch
1

Hi All,

https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html

In logstash output elasticsearch plugin, there are 3 protocols to talk to elasticsearch,

I don't really understand whats different beacuse the protocol both "node" and "http" are using http port to communicate (it can be found in elasticsearch.yml), someone can help to explain what is it mean or differentiation? thanks

############################## Network And HTTP ###############################

# Elasticsearch, by default, binds itself to the 0.0.0.0 address, and listens
# on port [9200-9300] for HTTP traffic and on port [9300-9400] for node-to-node
# communication. (the range means that if the port is busy, it will automatically
# try the next port).

# Set the bind address specifically (IPv4 or IPv6):
#
#network.bind_host: 192.168.0.1

# Set the address other nodes will use to communicate with this node. If not
# set, it is automatically derived. It must point to an actual IP address.
#
#network.publish_host: 192.168.0.1

# Set both 'bind_host' and 'publish_host':
#
#network.host: 192.168.0.1

# Set a custom port for the node to node communication (9300 by default):
#
#transport.tcp.port: 9300

# Enable compression for all communication between nodes (disabled by default):
#
#transport.tcp.compress: true

# Set a custom port to listen for HTTP traffic:
#
#http.port: 9200

Jason

2

I don't really understand whats different beacuse the protocol both "node" and "http" are using http port to communicate

No, the node protocol uses port 9300-9399 just like the transport protocol. Additional reading: Talking to Elasticsearch | Elasticsearch: The Definitive Guide [2.x] | Elastic

3

Hi Magnus, thanks, its very helpful

Jason