Which Elasticsearch node should logstash use in output filter?

I have an ELK infrastructure that has

  • 1 Kibana/Logstash node
  • 1 Elasticsearch client node
  • 3 Elasticsearch master nodes
  • 2 Elasticsearch data nodes

On my Logstash's output filter, which node should I point my Logstash elasticsearch filter to, the client node, or the data nodes? IOW

This?

output {
  elasticsearch {
    hosts => ["https://elk-CLIENT:9200"]
  }
}

or this?

output {
  elasticsearch {
    hosts => ["https://elk-DATA-0:9200", "https://elk-DATA-1:9200"]
  }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.