Load balancing filebeat

Elastic Stack Beats
1

I'm trying to set up filebeat sending to mulitple logstash hosts:
filebeat version 6.4.0 (amd64), libbeat 6.4.0 [34b4e2cc75fbbee5e7149f3916de72fb8892d070 built 2018-08-17 22:19:27 +0000 UTC]

OS: windows 2016

I have a filebeat.yml with the following stanza:
output.logstash:
'# The Logstash hosts
hosts: ["IP1:5044", "IP2:5044", "IP3:5044"]
loadbalance: true

(replace the IP1,IP2,IP3 with a valid IP)

When I run filebeat test output it stops after the first failure.
logstash: ip1:5044...
connection...
parse host... OK
dns lookup... OK
addresses: ip1
dial up... OK
TLS... WARN secure connection disabled
talk to server... OK
logstash: ip2:5044...
connection...
parse host... OK
dns lookup... OK
addresses: ip2
dial up... ERROR dial tcp ip2:5044: connectex: No connection could be made because the target machine actively refused it.

If IP1 is turned off, then it stops there.

So, am I missing a config somewhere or is it not doing the load balancing?

Edited: I added a ' before the hashtag so it wouldn't put the text in bold.

2

Replying to myself, I dropped a file into one of the directories filebeat cares about. It went to the first server and then complained the other two were down in the filebeat.log. I'll assume its working until tests prove its not.

3

You can install packetbeat on this system and see what it's connecting to. This way you can see if it sends data to all servers.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.