# Load balancing using logstash

**URL:** https://discuss.elastic.co/t/load-balancing-using-logstash/353439
**Category:** Logstash
**Tags:** elastic-stack-monitoring
**Created:** [February 16, 2024, 7:25am UTC](https://discuss.elastic.co/t/load-balancing-using-logstash/353439 "2024-02-16T07:25:26Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![kriti\_dabas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kriti_dabas/32/118506_2.png) [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)
#### Post date: [February 16, 2024, 7:25am UTC](https://discuss.elastic.co/t/load-balancing-using-logstash/353439/1 "2024-02-16T07:25:26Z")

</div>

I want to use two logstash so that if one goes down I can use the other one.  
Is there a chance of duplicacy if i am using two logstash with same pipelines?  
I will configure elasticsearch in the output of logstash.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 8, 2024, 6:07pm UTC](https://discuss.elastic.co/t/load-balancing-using-logstash/353439/2 "2024-03-08T18:07:55Z")

</div>

> [@kriti\_dabas](#):
>
> Is there a chance of duplicacy if i am using two logstash with same pipelines?

Yes. logstash does not have built-in load balancing. If you configure two logstash instances with file inputs then both will process every event. If you use something like kafka in front of logstash then that can do the load balancing for you.

---

<div class="post-metadata">

### Author: ![kriti\_dabas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kriti_dabas/32/118506_2.png) [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)
#### Post date: [March 11, 2024, 6:16am UTC](https://discuss.elastic.co/t/load-balancing-using-logstash/353439/3 "2024-03-11T06:16:01Z")

</div>

As I said I am using two logstash from one i am able to create index but from the other one I am not.  
First logstash is using ilm policy and the logs are coming second logstash simple index creation is not happening.  
I am not able to create index using these configurations.  
I am using the latest version 8.12.0 for both logstash and elasticsearch.  
Input is connecting with kafka but output is not working.

```auto
input {
  kafka {
    bootstrap_servers => "1.1.1.141:9092,1.1.1.142:9092,1.1.1.143:9092"
    topics => ["testing"]
    decorate_events => true
    enable_auto_commit => true
    auto_offset_reset => "earliest"
    group_id => "testing_user"
    consumer_threads => 3
    client_id => logstash2
  }
}

output {
if [@metadata][kafka][topic] == "testing"{
       elasticsearch {
          hosts => ["https://1.1.1.151:9200","https://1.1.1.152:9200"]
          ssl_certificate_authorities => '/etc/logstash/certs/http_ca.crt'
          user => "elastic"
          password => "elastic"
          manage_template => false
          data_stream => false
          index => "log-testing"
         }
     }
}

```

```auto
Edit the yml file using vim /etc/logstash/logstash.yml:

path.data: /var/lib/logstash
pipeline.ordered: auto
pipeline.ecs_compatibility: disabled   
config.test_and_exit: false
config.reload.automatic: true
queue.type: persisted
path.queue: /var/lib/logstash/data_queue
log.level: debug
path.logs: /var/log/logstash

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 8, 2024, 6:16am UTC](https://discuss.elastic.co/t/load-balancing-using-logstash/353439/4 "2024-04-08T06:16:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
