elasticsearch - What's the good architecture for ELK? -


i trying use elk build log analysis system. see lot of architecture use elk in different way. 1 of them

logstash->redis->logstash->elasticseach->kibana

the first logstash used collecting logs, second logstash used filter logs.

i not clear redis, have use it? why not using kafka?

the redis between 2 logstash instances buffer, there in case elasticsearch or logstash indexer goes down.

depending on you're processing logstash, may not need it. if you're reading log files, logstash (the shipper) stop sending logs when logstash (the indexer) overwhelmed. way, distributed cache (in log files!).

if you're using one-time events (e.g. traps or syslogs network devices), buffer redis or rabbitmq important store them until logstash (indexer) available.


Comments

Popular posts from this blog

Fail to load namespace Spring Security http://www.springframework.org/security/tags -

sql - MySQL query optimization using coalesce -

unity3d - Unity local avoidance in user created world -