Last year I found that Logstash doesn't perform load balancing between inputs and 'prefer' inputs that doesn't have pushback mechanism or that pushback is not relevant for them (like syslog input)
I'm thinking about pointing all of my FileBeat army, around 40 instances) to ship json-line formatted logs directly to our ES cluster using FileBeat's ES output.
Existing Logstash instances will still process logs that can't be shipped directly to ES.
The root cause is that there's a lot of contention on our Logstash instances which i'd like to minimize.
Can anyone comment on her/his experience with pointing FileBeat directly at ES cluster?