Receiver cluster

Use a cluster of Logstash servers to receive log file data, separate the incoming traffic, and add tags for further processing

The Receiver cluster can include one or more instances of Logstash.

As part of deploying scalable data ingestion architecture, you implement a basic configuration of Logstash that can receive log data and store it in a reliable data store without doing any further processing. By limiting the amount of processing, you ensure that you avoid increased processor usage in your data collection pipe line by not blocking the LFAs when they send data.

You can run multiple instances of Logstash with the same configuration in a cluster, which sits behind the high availability proxy servers.

You need to decide whether you want to process single or multiple line log files or both. You need to use different instances of Logstash for both types of log file. For more information, see Single and multi-line log files.