# Configuring Elasticsearch output in filebeat **URL:** \ **Category:** Elasticsearch\ **Created:** [February 20, 2020, 9:36am UTC](https://discuss.elastic.co/t/configuring-elasticsearch-output-in-filebeat/220143 "2020-02-20T09:36:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Ilayda\_Akinalan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ilayda_akinalan/32/54058_2.png) [@Ilayda\_Akinalan](https://discuss.elastic.co/u/Ilayda_Akinalan)\ **Post date:** [February 20, 2020, 9:36am UTC](https://discuss.elastic.co/t/configuring-elasticsearch-output-in-filebeat/220143/1 "2020-02-20T09:36:31Z")
Currently we are using Elasticsearch 6.7.1 and have: 3 master nodes and 4 data nodes. In filebeat configuration, should the output to elasticsearch point to master or the data nodes? We also have a load balancer for the data nodes, so can the output in filebeat get configured to send the load balancer instead of data nodes? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [February 20, 2020, 1:23pm UTC](https://discuss.elastic.co/t/configuring-elasticsearch-output-in-filebeat/220143/2 "2020-02-20T13:23:23Z")
pointing to the data nodes sounds good to me, so the master nodes do not have to deal with data but can focus on the management tasks. ---
**Author:** ![Ilayda\_Akinalan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ilayda_akinalan/32/54058_2.png) [@Ilayda\_Akinalan](https://discuss.elastic.co/u/Ilayda_Akinalan)\ **Post date:** [February 20, 2020, 2:22pm UTC](https://discuss.elastic.co/t/configuring-elasticsearch-output-in-filebeat/220143/3 "2020-02-20T14:22:00Z")
How about the load balancer, if we have that in front of the data nodes, should the output in filebeat get configured to send the data to the loadbalancer instead? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [February 20, 2020, 2:29pm UTC](https://discuss.elastic.co/t/configuring-elasticsearch-output-in-filebeat/220143/4 "2020-02-20T14:29:12Z")
That sounds ok as well. I'd just try to reduce the number of components involved, but that is more of a personal preference. One thing worth testing would be, what happens when an ES node is not reachable, but you only connect to the load balancer. I suppose that there is some backoff waitiing time before reconnecting, where as with a list of nodes, the next host would be tried. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 19, 2020, 2:29pm UTC](https://discuss.elastic.co/t/configuring-elasticsearch-output-in-filebeat/220143/5 "2020-03-19T14:29:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.