# Filebeat output to Kafka GSLB

**URL:** https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550
**Category:** Beats
**Tags:** filebeat
**Created:** [June 27, 2025, 5:54am UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550 "2025-06-27T05:54:16Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![rehanpfmr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rehanpfmr/32/139127_2.png) [@rehanpfmr](https://discuss.elastic.co/u/rehanpfmr)
#### Post date: [June 27, 2025, 5:54am UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550/1 "2025-06-27T05:54:16Z")

</div>

We are trying to solve a problem here with filebeat agent, we want to introduce an GSLB infront of Kafka clusters. Basically we have 2 kafka clusters in 2 different zones, we want filebeat to output to kafka based on reachability, Incase we have Zone 1 kafka down, filebeat should be able to connect to Zone2 via same pipeline without needing any restart.

Our kafka clusters are based on RKS, and we connect it via an FQDN:port with mTLS.

I know filebeat supports output to logstash with this approach, can it also do same for output.kafka: ?

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [June 27, 2025, 6:12am UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550/2 "2025-06-27T06:12:15Z")

</div>

If you ask, can FB send data to Kafka, yes, check [here](https://www.elastic.co/docs/reference/beats/filebeat/kafka-output). If you want a load balance, an active-passive configuration, I don't see an option to set.

---

<div class="post-metadata">

### Author: ![rehanpfmr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rehanpfmr/32/139127_2.png) [@rehanpfmr](https://discuss.elastic.co/u/rehanpfmr)
#### Post date: [June 27, 2025, 7:46am UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550/3 "2025-06-27T07:46:20Z")

</div>

output.kafka:  
enabled: true  
hosts: ["[abc.domain.com:443](http://abc.domain.com:443)"]  
topic: filebeat1

//

[abc.domain.com](http://abc.domain.com) is DNS which resolves to an LTM beneath.

---

<div class="post-metadata">

### Author: ![rehanpfmr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rehanpfmr/32/139127_2.png) [@rehanpfmr](https://discuss.elastic.co/u/rehanpfmr)
#### Post date: [June 27, 2025, 7:46am UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550/4 "2025-06-27T07:46:49Z")

</div>

Can this be achieved?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 27, 2025, 3:48pm UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550/5 "2025-06-27T15:48:47Z")

</div>

What is exactly your issue? Is not clear.

What is working and what is not working?
