Design issue or simple limitation?

[pierreact (Pierre)]

Hello,

In lumberjack output, I see hosts is an array.
2 questions:

1. Is it failover only or also load balancing? The documentation is not very talkative.
2. ssl_certificate... Are we unable to have one cert per host also?

https://www.elastic.co/guide/en/logstash/current/plugins-outputs-lumberjack.html

Thank you

[pierreact (Pierre)]

Anyone please?

[Moritz_Kiesewetter]

In my experience it's kind of both.
I do not use lumberjack output, but i do know what you mean by other .conf files.

I put in 3 Hosts, and i noticed when i was reindexing a lot of data, that one of my Elastic-Nodes was under heavy traffic. So i took a look in my Network tool, and the Outputs stopped choosing the host which was so busy. I guess it has something to do with the response time from your certain hosts.
And Of course, if one host from your array is not reachable, this option works as a failover by choosing a node which is reachable.
Can't answer your second question, sorry.

Hope this helps..

[pierreact (Pierre)]

@Moritz_Kiesewetter Thank you for your reply, interesting about the balancing on heavily used nodes, indeed, I'll see if I observe the same behavior.

About the SSL cert, I regenerated a self signed cert with two keys attached to it. Works fine, good I had this administrative option. I think this is a design issue.