# Filebeat forwarding to Logstash running in Mesos **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 29, 2016, 9:25pm UTC](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238 "2016-08-29T21:25:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![surajs](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@surajs](https://discuss.elastic.co/u/surajs)\ **Post date:** [August 29, 2016, 9:25pm UTC](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238/1 "2016-08-29T21:25:44Z")
In my current organization, we are planning to run our ELK stack on Mesos. For log-forwarding, we plan on having filebeat instance running on each of the hosts that run a backend service. Is there a recommended way to configure file-beat to forward messages to logstash hosted as a mesos task? Since mesos master can move tasks around depending on resource availability logstash host/port may not be static afterall. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 30, 2016, 5:54am UTC](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238/2 "2016-08-30T05:54:13Z")
Sounds more like a Mesos question. Filebeat has no support for dynamic hosts and ports apart from what DNS provides. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [August 30, 2016, 11:46am UTC](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238/3 "2016-08-30T11:46:17Z")
filebeat does a DNS lookup every time it connects/reconnects. If host name remains, but IP:PORT changes, filebeat should still be able to reconnect to new IP, given filebeat can fetch updated DNS entry. ---
**Author:** ![surajs](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@surajs](https://discuss.elastic.co/u/surajs)\ **Post date:** [August 30, 2016, 6:02pm UTC](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238/4 "2016-08-30T18:02:08Z")
Thanks @magnusbaeck, @steffens. DNS was one of the ways we were planning to resolve this. Shall continue to research if there is any other way. Shall keep you posted on the approach that we go forward with. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [August 30, 2016, 9:32pm UTC](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238/5 "2016-08-30T21:32:25Z")
Thanks. Really interested how this goes. btw. you can try to reserve multiple logstash hosts being pre-configured (`ls1`, `ls2`, `ls3`) in beats and enable some form of load-balancing. Then you might be able to start/shutdown any number of instances as required and beats will start to balance batches of events among number of configured and available hosts only (ensure `spooler_size = N * bulk_max_size`). If logstash host is down (not needed to cope with current load), it will not participate in load-balancing until reconnect was successful. Having 2 instances active might smoothen the move of one host at a time. Just an idea, no idea how feasible this would be with mesos. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 19, 2016, 9:26pm UTC](https://discuss.elastic.co/t/filebeat-forwarding-to-logstash-running-in-mesos/59238/6 "2016-09-19T21:26:26Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.