I have single NAS logs share connected to my application nodes, and logstash node. One logstash instance is reading logfiles, parsing and shipping to ES. Now, I want to add failover to logstash by deploying it to second node and connecting to the same files. Question is:
Can multiple logstash instances read the same files without duplicating whole traffic to ES?
If not, can I deploy two logstash instances in 'active-passive' mode?
I dont want to use beats*/logstash forwarder because there is no need for additional overhead, logs can be read directly from disk from any logstash node and this is faster and it simplifies ELK architecture, without additional points of failure.