File beat to switch logstash host in case of failure

[Honda_fred_elk (Fredrick Yessaian)]

Hi,

I am using filebeat to export logs from client machine to logstash server..

My scenario is:

1. I have installed logstash (ELK server) in two servers. both the logstash will be listening always.
2. I need to export logs to always to Host 1.
3. If there is any issue (network or EKL Server down) in Host1... then filebeat has to export logs to Host 2.

I read that If I have more than one hosts configured in output.logstash.hosts[] in filebeat.yml.. then every single log will be sent to both the hosts.

But I dont want to send both the hosts always..
It should be sent Host 1 always, In case of failure then filebeat should send logs to Host 2.

Is this scenario possible in filebeat configuration?

Thanks

[warkolm (Mark Walkom)]

If you are referring to https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html#loadbalance then it doesn't send every event to all hosts, it "balances published events onto all Logstash hosts", which means it will send some to host 1, some to host 2, some to host N.

That means that if host 1 is down, it will switch to using the other hosts.

[steffens (Steffen Siering)]

if load balancing is disabled, but mutliple hosts are configured, one host is selected randomly (there is no precedence). If one host becomes unreachable, another one is selected randomly.

[warkolm (Mark Walkom)]

I've raised this PR to clear this up https://github.com/elastic/beats/pull/3476