Imagine a situation where an organization has data centers across the world and wants to centrally manage and collect logs, as depicted in the following image:
Centralized Collection of Distributed Data
We can implement such a requirement in a couple of different ways.
Option 1, depicts a scenario where we collect the data centrally in a Central Data Center and there are local Queues defined in each Remote Data Center that talk directly to the Logstash processors in the Central Data Center:
Centralized Collection of Distributed Data - Option 1
Option 2, shown in the following image, depicts a different architecture, where the beats agents in various remote data centers write directly to the Logstash Collector in the Central Data Center:
There is no right or wrong approach to building a Multi-Data Center Collector architecture. It depends on a variety of factors, which are outside the scope of this book.