Filebeat Load balance logstash with kubernetes service

[sivakr (Siva Kumar)]

In my kubernetes cluster

I have Filebeat running on a node and I have 6 instances of logstash for load balancing.

This is the configuration in Filebeat

output.logstash:
hosts: [logstash.logstash:5044]
bulk_max_size: 4000

But when I check the events In rate for all logstash instances I can see few instances being idle having no load at all (Attached Screenshot

)

Does the load balance works with kubernetes service ? Or should I manually give all the endpoints but thats not the best practice though.

[Christian_Dahlqvist]

@sivakr

hosts: [logstash.logstash:9600]

That looks odd. The 9600 port in Logstash is usually reserved for exposing monitoring data. Have you defined a beats input using this port?

[sivakr (Siva Kumar)]

My bad I wrongly typed. Its port 5044