0
votes

I am using logstash for ETL purpose and have 3 indexes in the Elastic search .Can I insert documents into my 3 indexes through 3 different logtash processes at the same time to improve the parallelization or should I insert documents into 1 index at a time.

My elastic search cluster configuration looks like: 3 data nodes 1 client node

3 data nodes - 64 GB RAM, SSD Disk 1 client node - 8 GB RAM

Shards - 20 Shards Replica - 1 Thanks

1

1 Answers

1
votes

As always it depends. The distribution concept of Elasticsearch is based on shards. Since the shards of an index live on different nodes, you are automatically spreading the load.

However, if Logstash is your bottleneck, you might gain performance from running multiple processes. Though if running multiple LS process on a single machine will make a positive impact is doubtful.

Short answer: Parallelising over 3 indexes won't make much sense, but if Logstash is your bottleneck, it might make sense to run those in parallel (on different machines).

PS: The biggest performance improvement generally is batching requests together, but Logstash does that by default.