title: Sending logs to elastic search using logstash
body: <p>i have single node ELK set up in 10.x.x.1 where i have installed logstash, elastic search and kibana.</p>
  
  <p>i have my application running in another server 10.x.x.2 and i want my logs to be forwarded to elastic search.</p>
  
  <p>My log file /var/log/myapp/myapp.log in 10.x.x.2</p>
  
  <p>In 10.x.x.1 i provided this input in /etc/logstash/conf.d</p>
  
  <pre><code>input {
    file {
      path =&gt; "/var/log/myapp/myapp.log"
      type =&gt; "syslog"
    }
  }
  
  output {
     elasticsearch {
         hosts =&gt; ["10.252.30.11:9200"]
         index =&gt; "versa"
     }
  }
  </code></pre>
  
  <p>My questions are as below </p>
  
  <ol>
  <li>Do i need to install logstash in 10.x.x.2</li>
  <li>How can i grep only for the lines having "Error" </li>
  <li>Everyday my app produces a log of size 10MB. i just want to know, if i can add one more node to my elastic search so that the space wont fill up. </li>
  <li>i dont want to keep my logs permanently in elastic search . Is there any way i can set an expiry time for the logs that am sending ? 
  i.e. delete the logs after 7 days . </li>
  </ol>