# Load balancing filebeat

**URL:** <https://discuss.elastic.co/t/load-balancing-filebeat/198963>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 10, 2019, 7:17pm UTC](https://discuss.elastic.co/t/load-balancing-filebeat/198963 "2019-09-10T19:17:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![an0nemus](https://avatars.discourse-cdn.com/v4/letter/a/e9bcb4/32.png) [@an0nemus](https://discuss.elastic.co/u/an0nemus)\
**Post date:** [September 10, 2019, 7:17pm UTC](https://discuss.elastic.co/t/load-balancing-filebeat/198963/1 "2019-09-10T19:17:08Z")

</div>

I'm trying to set up filebeat sending to mulitple logstash hosts:  
filebeat version 6.4.0 (amd64), libbeat 6.4.0 [34b4e2cc75fbbee5e7149f3916de72fb8892d070 built 2018-08-17 22:19:27 +0000 UTC]

OS: windows 2016

I have a filebeat.yml with the following stanza:  
output.logstash:  
'# The Logstash hosts  
hosts: ["IP1:5044", "IP2:5044", "IP3:5044"]  
loadbalance: true

(replace the IP1,IP2,IP3 with a valid IP)

When I run filebeat test output it stops after the first failure.  
logstash: ip1:5044...  
connection...  
parse host... OK  
dns lookup... OK  
addresses: ip1  
dial up... OK  
TLS... WARN secure connection disabled  
talk to server... OK  
logstash: ip2:5044...  
connection...  
parse host... OK  
dns lookup... OK  
addresses: ip2  
dial up... ERROR dial tcp ip2:5044: connectex: No connection could be made because the target machine actively refused it.

If IP1 is turned off, then it stops there.

So, am I missing a config somewhere or is it not doing the load balancing?

Edited: I added a ' before the hashtag so it wouldn't put the text in bold.

---

<div class="post-metadata">

**Author:** ![an0nemus](https://avatars.discourse-cdn.com/v4/letter/a/e9bcb4/32.png) [@an0nemus](https://discuss.elastic.co/u/an0nemus)\
**Post date:** [September 10, 2019, 7:42pm UTC](https://discuss.elastic.co/t/load-balancing-filebeat/198963/2 "2019-09-10T19:42:59Z")

</div>

Replying to myself, I dropped a file into one of the directories filebeat cares about. It went to the first server and then complained the other two were down in the filebeat.log. I'll assume its working until tests prove its not.

---

<div class="post-metadata">

**Author:** ![daniel\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_a/32/48390_2.png) [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\
**Post date:** [September 11, 2019, 10:03pm UTC](https://discuss.elastic.co/t/load-balancing-filebeat/198963/3 "2019-09-11T22:03:06Z")

</div>

You can install packetbeat on this system and see what it's connecting to. This way you can see if it sends data to all servers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2019, 10:08pm UTC](https://discuss.elastic.co/t/load-balancing-filebeat/198963/4 "2019-10-09T22:08:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.