# Load balance output between multiple hosts **URL:** \ **Category:** Logstash\ **Created:** [July 12, 2018, 7:58am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694 "2018-07-12T07:58:17Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![xShadow](https://avatars.discourse-cdn.com/v4/letter/x/b4bc9f/32.png) [@xShadow](https://discuss.elastic.co/u/xShadow)\ **Post date:** [July 12, 2018, 7:58am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/1 "2018-07-12T07:58:17Z")
Hi, I have a logstash instance with multiple hosts output. According to the documentation, logstash should load balance across the hosts specified. However, I am receiving the logs on both of the elasticsearch instance. Am I doing something wrong and how should I be configuring it? Below is a sample of my configuration. Thanks in advance. output { elasticsearch { hosts =\> ["x.x.x.x:9200", "y.y.y.y:9200"] } } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 12, 2018, 8:49am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/2 "2018-07-12T08:49:25Z")
> [@xShadow](#): > > However, I am receiving the logs on both of the elasticsearch instance. How are you determining this? Are you seeing duplicates? ---
**Author:** ![xShadow](https://avatars.discourse-cdn.com/v4/letter/x/b4bc9f/32.png) [@xShadow](https://discuss.elastic.co/u/xShadow)\ **Post date:** [July 12, 2018, 9:15am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/3 "2018-07-12T09:15:36Z")
Hi, I'm not sure if this is the correct approach but I configured it to be two single-node cluster so as to see which elasticsearch node will receive the logs. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 12, 2018, 9:17am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/4 "2018-07-12T09:17:48Z")
And what are you seeing? Do all logs get indexed into both instances? ---
**Author:** ![xShadow](https://avatars.discourse-cdn.com/v4/letter/x/b4bc9f/32.png) [@xShadow](https://discuss.elastic.co/u/xShadow)\ **Post date:** [July 12, 2018, 9:43am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/5 "2018-07-12T09:43:58Z")
Yup, the logs appears in both of the instances. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 12, 2018, 9:58am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/6 "2018-07-12T09:58:09Z")
Can you give the output of the [cluster stats API](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/cluster-stats.html) from both nodes? ---
**Author:** ![xShadow](https://avatars.discourse-cdn.com/v4/letter/x/b4bc9f/32.png) [@xShadow](https://discuss.elastic.co/u/xShadow)\ **Post date:** [July 16, 2018, 4:05am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/7 "2018-07-16T04:05:19Z")
Hi there, Sorry for the late reply. I have changed my configuration file and have noticed that the output now only goes to one instance at a time. I was just wondering if this is just a coincidence or does the "start\_position" in the input plugin affects this? i.e. I changed start\_position from "beginning" to "end". Also, may I ask how the load balancing is done? E.g. is it round robin or least used? As for the cluster stats API, here are the links to the pastebin: Node1: [https://pastebin.com/1TQu4Q0k](https://pastebin.com/1TQu4Q0k) Node2: [https://pastebin.com/MjSwGJwh](https://pastebin.com/MjSwGJwh) Once again, sorry for the late reply and thank you in advance! Edit: Replaced pastebin url as it expired. ---
**Author:** ![xShadow](https://avatars.discourse-cdn.com/v4/letter/x/b4bc9f/32.png) [@xShadow](https://discuss.elastic.co/u/xShadow)\ **Post date:** [July 18, 2018, 8:01am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/8 "2018-07-18T08:01:32Z")
bump ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 18, 2018, 8:17am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/9 "2018-07-18T08:17:17Z")
> [@xShadow](#): > > I was just wondering if this is just a coincidence or does the "start\_position" in the input plugin affects this? This affects how Logstash reads files, not where the data is sent. > [@xShadow](#): > > Also, may I ask how the load balancing is done? E.g. is it round robin or least used? Am not sure. ---
**Author:** ![xShadow](https://avatars.discourse-cdn.com/v4/letter/x/b4bc9f/32.png) [@xShadow](https://discuss.elastic.co/u/xShadow)\ **Post date:** [July 18, 2018, 8:26am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/10 "2018-07-18T08:26:44Z")
> [@Christian\_Dahlqvist](#): > > This affects how Logstash reads files, not where the data is sent. That is my thought too. However, that was the only part that I changed during my testing, so I'm still not really sure how the load balancing is done. > [@Christian\_Dahlqvist](#): > > Am not sure. Okay, thank you so much for the help though! 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 15, 2018, 8:26am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694/11 "2018-08-15T08:26:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.