elasticsearch - What's the good architecture for ELK? -
i trying use elk build log analysis system. see lot of architecture use elk in different way. 1 of them
logstash->redis->logstash->elasticseach->kibana
the first logstash used collecting logs, second logstash used filter logs.
i not clear redis, have use it? why not using kafka?
the redis between 2 logstash instances buffer, there in case elasticsearch or logstash indexer goes down.
depending on you're processing logstash, may not need it. if you're reading log files, logstash (the shipper) stop sending logs when logstash (the indexer) overwhelmed. way, distributed cache (in log files!).
if you're using one-time events (e.g. traps or syslogs network devices), buffer redis or rabbitmq important store them until logstash (indexer) available.
Comments
Post a Comment