Thanks for your reply 
I just need a way to increase scalability and resilience. So I would add more logstash instances. But I want to know what are the disadvanteges too.
I just noticed that I can configure the beats to do the load balancing with multiple instances of logstash: How to make Filebeat send events to multiple logstash in roundrobin
So at this point what is the best option to get more scalability and resilience?
- Add multiple host and loadbalance=true in the beats configuration
- Use logstash as loadbalancer with lumberjack plugin
- Use a dedicated tool like NGINX or HAProxy
- or other