Filebeat in HA through active passive

Elastic Stack Beats
1

I have a requirement to model ELK stack with failover across multiple AWS region.
While there are no issues with running multiple instances of Logstash and Elasticsearch in active/active mode, the filebeat is expected to ship unique files to logstash from AWS EFS. Hence the filebeat has been modelled as active/passive with data folder in AWS EFS and ensuring only 1 instance of filebeat running and shipping files from AWS EFS to logstash.

Is this the right model of filebeat to work or there are other ways to read same file by multiple filebeat process but ensuring only 1 unique file goes to logstash?

2

Request any advice on this?

3

Filebeat is not clustered so multiple instances are not aware what others are doing/have done. What you are doing therefore as far as I can see seems fine.

4

Thank you for the response

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.