Introduction
Elasticsearch 5.x introduces a set of powerful functionalities, targeting the problems that arise during ingestion of documents via the ingest node.
An Elasticsearch node can be master, data, or ingest.
The idea to split the ingest component from the others, is to create a more stable cluster due to problems that can arise during pre-processing documents.
To create a more stable cluster, the ingest nodes should be isolated by the master or data nodes, in the event that some problems may occur, such as a crash due to an attachment plugin and high loads due to complex type manipulation.
Note
The ingestion node can replace a Logstash installation in simple scenarios.