I am looking at initial start of 2 logstash machines. I find this a problem but its what I was given: 1 blade with 2 vms on it each which will have its own LS. But I will try to find some more details on what hardware I have to use.
I think I am understanding this more! So broker is just trying to distribute as evenly as possible to many LS instances. But does the throughput or messages/sec determine the requirement of a broker? For some reason I am finding this misleading in so many chats and blogs that brokers are needed for a single reason, high volume.
I might be wrong but I found this on git that LSF or I am using log courier that downtime is not a problem with rotation. Meaning if LS is bottled up or shutdown LSF will keep the file open. Any new rotations will be read and kept open. Once LS frees up or comes online it will resume. I should probably read the source code or trace the code to see how this really works! Very interesting stuff.