Page History

...

Logstash can aggregate log messages from multiple nodes and multiple log files. In a typical production environment, cloudstack is configured with multiple management server instances for scalability and redundancy. One instance of logstash will be configured to run on each of the management server which and will ship the log to a AMQP broker. The logstash process is reasonably light in terms of memory consumption and should not impact the management server. 

...

• Same as Management Server: Each management server will be configured to run as a elasticsearch node. This particular configuration though simple can impact the management server as the elasticsearch service can be memory and cpu intensive. One of the management servers will be configured as the master node. The same node  will also run the amqp instance.
• Seperate Elasticsearch nodes: In this configuration the systemvm template can be used to spawn elasticsearch nodes. The number of such nodes should be configurable via a global parameter. One of the  node will be designated as the master node, which will also run the amqp instance.

TODO: Details on using systemvm for elasticsearch nodes.

...