Load balance the events between the Logstash hosts

Elastic Stack Beats
1

This is regarding load balancing option we have for filebeat.

logstash:
hosts: ["host1:5044","host2:5044"]
loadbalance: true

What will be the algorithm it will be using if we enable load balance?
We are using codec => multiline in loagstash.
beats {
port => 9400
ssl => true
ssl_certificate => "/etc/logstash/server.crt"
ssl_key => "/etc/logstash/server.key"
#type => "syslog"
codec => multiline {
# Grok pattern names are valid! :slight_smile:
pattern => "^%{TIMESTAMP_ISO8601} |^%{DATA}\s*-\s*%{DATESTAMP}"
negate => true
what => previous
}

If we enable loadbalance in filebeat and if we are using above multiline filter in logstash , will it create any confusion if multiple log lines get delivered to different logstash instance?

2

Multiline processing is ideally done as close to the source as possible as it removes the need to keep events ordered at later stages. As Fliebeat now supports multiline processing before sending events off to Logstash, I would recommend doing the processing there instead of in Logstash if possible. This would allow load balancing between Logstash instances without causing errors.

3

Thank you