I don't understand. Can you post sample configs?
e.g.
filebeat:
...
spool_size: 4096
...
output:
logstash:
hosts:
- logstash1:5044
- logstash2:5044
loadbalance: true
bulk_max_size: 2048
worker: 1
will get you some lock-step load-balancing. For lock-step loadbalancing use spool_size = worker * #hosts * bulk_max_size. Having just one host one can do (2 load balance workers):
filebeat:
...
spool_size: 4096
...
output:
logstash:
hosts:
- logstash:5044
loadbalance: true
bulk_max_size: 2048
worker: 2