title: Centralized ELK vs Centralized EK + Multiple Logstash
body: <p>We want to set up a common logging interface across all the product teams in our company. We chose ELK for this and i want some advice regarding the set up:</p>
  
  <p>One way is to have centralized ELK set up and all teams can use some sort of log forwarder e.g. FileBeat to send logs to common logstash. The issue with this i feel is : If teams want to use filters on the logs for analyzing log messages, they would need to access the common ELK machine to add filters as Beats doesn't support groking or any other filtering.</p>
  
  <p>Second way is to have different logstash servers per team and all those will point to common Elastic Search server. This way teams are free to modify/add grok filters.</p>
  
  <p>Please enlighten me if i am missing something or may be i am wrong in understanding. Other ideas are welcome.</p>