# Logstash one single point failure

**URL:** <https://discuss.elastic.co/t/logstash-one-single-point-failure/111220>\
**Category:** Logstash\
**Created:** [December 12, 2017, 3:26am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220 "2017-12-12T03:26:19Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 12, 2017, 3:26am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220/1 "2017-12-12T03:26:19Z")

</div>

Hi,everyone:  
this is my ELK structure:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2fccdda3cccac9564e0b73ca0bd58959f22208d0.png)  
I am afraid that if the logstash host crash, and all the system can't run.  
so if there's a way to prevent the situation occur, such as joining a logstash to stand by.

thank you in advance!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 12, 2017, 7:03am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220/2 "2017-12-12T07:03:50Z")

</div>

Have you read [https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html](https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html)? What kind of inputs and filters do you have?

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 12, 2017, 7:40am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220/3 "2017-12-12T07:40:07Z")

</div>

this is my logstash config:

```
input{
tcp{
	host => "192.168.0.159"
	port => 5510
	codec => json
	type =>"ntopng-*"
}
}
filter{
	if[type]=="ntopng-*"
	{
		if "" not in [IPV4_SRC_ADDR] and "" not in [IPV6_SRC_ADDR]
		{
			drop{}
		}
	}
}
output{
elasticsearch {
            codec => "json" 
            hosts => ["192.168.0.159:9200","192.168.0.58:9200","192.168.0.154:9200"]

    }
if[type]=="ntopng-*"
{
	stdout{codec=> rubydebug}
}
}

```

it seems beats can load balance across a group of Logstash nodes?

thank you 🙂

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 12, 2017, 8:14am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220/4 "2017-12-12T08:14:22Z")

</div>

> it seems beats can load balance across a group of Logstash nodes?

Yes. If your TCP clients can do that or if you can stick two or more Logstash instances behind a load balancer that's another simple option.

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 15, 2017, 9:37am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220/5 "2017-12-15T09:37:39Z")

</div>

which load balancer do you suggest? 🙂  
I have researched kafka, I have some problems in sending data to logstash.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 15, 2017, 10:16am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220/6 "2017-12-15T10:16:54Z")

</div>

> which load balancer do you suggest?

I don't have sufficient experience with load balancers to give a specific recommendation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2018, 10:17am UTC](https://discuss.elastic.co/t/logstash-one-single-point-failure/111220/7 "2018-01-12T10:17:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.