Events were collected from about thousands of machine on centralize Windows Event Collector (WEC) server. Windows Event Forwarder configure using GPO to collect events of each machine on WEC. For high availability we configured two WEC server which receives same (duplicate) events on both servers. Winlogbeat installed on single WEC server that sends data to single Elasticsearch cluster. We can not setup Winlogbeat on both server as it will lead to duplication of events on elsticsearch
Configure winlogbeat on both WEC server so to avoid duplicate event forwarding. How to handle failover if one server goes down then second server winlogbeat should trigger and send data to elasticsearch without any loss of event data
I am new to ELK stack kindly help in directing me towards best approch.
Thanks in advance