I have two ES clusters with cluster 1 running on 2.4.x version and cluster 2 running on 5.1.1 version. Currently logstash (5.x version) is writing indexes to cluster 1 (2.4.x) with the following output configuration in logstash:
output {
elasticsearch {
hosts => "cluster1:9200"
index => "index-pattern-%{+YYYY.MM.dd}"
sniffing => "true"
template_overwrite => true
}}
I want to feed live data to cluster2 (5.1.1 version) by changing the following logstash output configuration file to:
output {
elasticsearch {
hosts => "cluster1:9200"
index => "index-pattern-%{+YYYY.MM.dd}"
sniffing => "true"
template_overwrite => true
}
elasticsearch {
hosts => "cluster2:9200"
index => "index-pattern-%{+YYYY.MM.dd}"
sniffing => "true"
template_overwrite => true
}
}
Is this possible? Or is there any better idea for feeding live data to two different clusters?