# HAProxy conf for Logstash

**URL:** <https://discuss.elastic.co/t/haproxy-conf-for-logstash/312773>\
**Category:** Logstash\
**Created:** [August 24, 2022, 7:41am UTC](https://discuss.elastic.co/t/haproxy-conf-for-logstash/312773 "2022-08-24T07:41:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![magnorod](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@magnorod](https://discuss.elastic.co/u/magnorod)\
**Post date:** [August 24, 2022, 7:41am UTC](https://discuss.elastic.co/t/haproxy-conf-for-logstash/312773/1 "2022-08-24T07:41:35Z")

</div>

Hello,  
I'm contacting you because I can't get the load balancing of Logstash via HAproxy to work properly.  
I always have 2 Logstash out of the 4 that share the flow. I would like the flow to be fairly distributed between each Logstash node.

## HAproxy conf

```conf
global
 log /dev/log local0

defaults
  timeout connect 3s
  timeout client 5s
  timeout server 5s
  log global
  mode tcp

  option tcplog
#https://www.haproxy.com/documentation/hapee/latest/onepage/#option%20tcplog
  
  balance roundrobin
#https://www.haproxy.com/documentation/hapee/latest/onepage/#balance

frontend logstash
  bind *:5044
  default_backend logstash_backend

backend logstash_backend
  server logstash01 logstash01.###:5044 check
  server logstash02 logstash02.###:5044 check
  server logstash03 logstash03.###:5044 check
  server logstash04 logstash04.###:5044 check

frontend elasticsearch
  bind *:9200
  default_backend elasticsearch_backend

backend elasticsearch_backend
  server elastic02 elastic02.###:9200 check
  server elastic03 elastic03.###:9200 check
  server elastic04 elastic04.###:9200 check
  server elastic05 elastic05.###:9200 check
  server elastic06 elastic06.###:9200 check

frontend elasticsearch2
  bind *:9300
  default_backend elasticsearch_backend2

backend elasticsearch_backend2
  server elastic02 elastic02.###:9300 check
  server elastic03 elastic03.###:9300 check
  server elastic04 elastic04.###:9300 check
  server elastic05 elastic05.###:9200 check
  server elastic06 elastic06.###:9200 check

```

For example, I left it running one night and I have a totally uneven distribution of ingested events.

| node\_name | events ingested |
| --- | --- |
| logstash01 | 171.6m |
| logstash02 | 183m |
| logstash03 | 4.8m |
| logstash04 | 3.9m |

 ![logstash-load-discuss](https://us1.discourse-cdn.com/elastic/original/3X/5/5/555d10a4e3cc29e032c8afaf8f1bd02c0af9a21f.png)

## Logstash pipeline

```conf
input {
  beats {
    port => 5044
    ssl => false
  }
}
###etc

```

## Filebeat conf

```auto
# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The HAproxy loadbalancers
  hosts: ["beats.###:5044", "ansible.###:5044"]
  loadbalance: true
  worker: 2
  compression_level: 0

```

**ELK stack 8.3.0**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2022, 7:42am UTC](https://discuss.elastic.co/t/haproxy-conf-for-logstash/312773/2 "2022-09-21T07:42:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.