9

I'm planning on using Elasticsearch to log all my application activities (like an audit log).

Considering how I have direct control over the application, should I directly push the data into Elasticsearch using their REST APIs or should I somehow use Logstash to feed data into Elasticsearch?

Is there any reason I should use Logstash when I can directly push data into Elasticsearch? It's an additional layer to manage.

Thihara
  • 7,031
  • 2
  • 29
  • 56
  • 2
    What would happen to your application logs if you need to upgrade your ES server? Where do they go while your ES is down for maintenance or for any other reason? If you don't care about that and/or if you don't need to apply any processing to your logs (geoip, grok, etc), then you don't really need logstash. – Val Jun 09 '17 at 05:25
  • I thought I can have a failover in the ES setup to actually reduce any failures related to ES. Is that not possible for some reason in ES? – Thihara Jun 09 '17 at 05:54
  • If you have multiple nodes and a load balancer in front of them, you have failover. – Val Jun 09 '17 at 06:02

1 Answers1

8

If you need to parse different log formats (eventlog, syslog and so on), support different transports (UDP, TCP and so on) and log outputs use Logstash. If http is good for you and you collect logs only from one application use ES directly. Logstash is an additional tool. Details are here.

Serg Dinarov
  • 145
  • 1
  • 6
Vasyl Zvarydchuk
  • 3,789
  • 26
  • 37