# Where should logstash live? Cloud vs OnPrem

**URL:** <https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472>\
**Category:** Logstash\
**Created:** [November 14, 2017, 12:09am UTC](https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472 "2017-11-14T00:09:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Hakopyan](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@Mike\_Hakopyan](https://discuss.elastic.co/u/Mike_Hakopyan)\
**Post date:** [November 14, 2017, 12:09am UTC](https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472/1 "2017-11-14T00:09:16Z")

</div>

I'm very new to LogStash and Elasticsearch. I'd like to know where to install Logstash; on prem or cloud? I have multiple locations where I'd be collecting log files with Beats and shipping to Logstash, then to Elasticsearch hosted on the cloud. Finally visualizing with Kibana. I don't want these log files being copied or shipped accross WAN links every day. Ideally I'd like for the log files to flow over via our Internet pipe to a hosted environment for Logstash.

Any use cases similar to mine would be nice to read.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 14, 2017, 5:17am UTC](https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472/2 "2017-11-14T05:17:55Z")

</div>

There's three main options;

1. Filebeat \> local Logstash -\> remote Elasticsearch
2. Filebeat \> remote Logstash -\> remote Elasticsearch
3. Filebeat \> local Logstash -\> local Elasticsearch + CCS cluster

With 2 you would then use [cross cluster search](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/modules-cross-cluster-search.html) to pull the aggregated data to the CCS cluster and visualise that with Kibana.

> [@Mike\_Hakopyan](#):
>
> I don't want these log files being copied or shipped accross WAN links every day. Ideally I'd like for the log files to flow over via our Internet pipe to a hosted environment for Logstash.

Aren't these the same thing?

---

<div class="post-metadata">

**Author:** ![Mike\_Hakopyan](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@Mike\_Hakopyan](https://discuss.elastic.co/u/Mike_Hakopyan)\
**Post date:** [November 14, 2017, 9:10pm UTC](https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472/3 "2017-11-14T21:10:44Z")

</div>

So in the case of option 2 where Logstach is remote, what are some services that I can use for that? AWS? or is there such services like Elastcisearch where a complete turnkey environment can be setup on the cloud?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 14, 2017, 9:47pm UTC](https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472/4 "2017-11-14T21:47:04Z")

</div>

You can use Logstash on GCP/Azure/AWS or any other cloud provider.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2017, 9:47pm UTC](https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472/5 "2017-12-12T21:47:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.