I would like to know whether Winlogbeat supports the following use case:
Suppose I have 1000 machines that are configured with 2 Logstash output hosts A and B.
I would like all traffic to be sent to A. When A becomes unreachable, traffic should be sent to B.
Documentation says hosts are picked randomly for connections. Is there a workaround to implement prioritization?
With the current configuration, it cannot be predicted how many machines would send logs to host A and how many to host B if both are reachable.
If I set the loadbalance flag to true, what would happen when host A becomes unresponsive? Would Winlogbeat redirect ALL messages to host B? If yes, how frequently would it try to re-establish a connection with host A to restore load balancing?