This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations »
Elastic Docs ›Elastic Ingest Reference Architectures [8.16] ›Elastic Agent to Logstash to Elasticsearch

Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy

edit

Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy

edit
Image showing Elastic Agents collecting data and sending to Logstash for proxying before sending on to Elasticsearch
Ingest model
Data path: Elastic Agent to Logstash as bridge to Elasticsearch on Elastic Stack network
Control path: Elastic Agent to Fleet Server to Elasticsearch
Use when
Agents have network restrictions for connecting to Elasticsearch on Elastic Stack deployed outside of the agent network
Example
You can send data from multiple Elastic Agents through your demilitarized zone (DMZ) to Logstash, and then use Logstash as a proxy through your firewall to Elasticsearch Service. This approach helps reduce the number of firewall exceptions needed to forward data from large numbers of Elastic Agents.

Resources

edit

Info on configuring Elastic Agent:

Info on Logstash and Logstash plugins:

Info on Elasticsearch:

« Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations »