Sending logs to elastic search using logstash
<p>i have single node ELK set up in 10.x.x.1 where i have installed logstash, elastic search and kibana.</p>

<p>i have my application running in another server 10.x.x.2 and i want my logs to be forwarded to elastic search.</p>

<p>My log file /var/log/myapp/myapp.log in 10.x.x.2</p>

<p>In 10.x.x.1 i provided this input in /etc/logstash/conf.d</p>

<pre><code>input {
  file {
    path =&gt; "/var/log/myapp/myapp.log"
    type =&gt; "syslog"
  }
}

output {
   elasticsearch {
       hosts =&gt; ["10.252.30.11:9200"]
       index =&gt; "versa"
   }
}
</code></pre>

<p>My questions are as below </p>

<ol>
<li>Do i need to install logstash in 10.x.x.2</li>
<li>How can i grep only for the lines having "Error" </li>
<li>Everyday my app produces a log of size 10MB. i just want to know, if i can add one more node to my elastic search so that the space wont fill up. </li>
<li>i dont want to keep my logs permanently in elastic search . Is there any way i can set an expiry time for the logs that am sending ? 
i.e. delete the logs after 7 days . </li>
</ol>