I am using filebeat to export logs from client machine to logstash server..
My scenario is:
- I have installed logstash (ELK server) in two servers. both the logstash will be listening always.
- I need to export logs to always to Host 1.
- If there is any issue (network or EKL Server down) in Host1... then filebeat has to export logs to Host 2.
I read that If I have more than one hosts configured in output.logstash.hosts in filebeat.yml.. then every single log will be sent to both the hosts.
But I dont want to send both the hosts always..
It should be sent Host 1 always, In case of failure then filebeat should send logs to Host 2.
Is this scenario possible in filebeat configuration?