# Two Logstash nodes. Same config. Persistent queue filling only in one of them

**URL:** <https://discuss.elastic.co/t/two-logstash-nodes-same-config-persistent-queue-filling-only-in-one-of-them/350229>\
**Category:** Logstash\
**Created:** [January 2, 2024, 11:43am UTC](https://discuss.elastic.co/t/two-logstash-nodes-same-config-persistent-queue-filling-only-in-one-of-them/350229 "2024-01-02T11:43:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nahiko](https://avatars.discourse-cdn.com/v4/letter/n/d78d45/32.png) [@nahiko](https://discuss.elastic.co/u/nahiko)\
**Post date:** [January 2, 2024, 11:43am UTC](https://discuss.elastic.co/t/two-logstash-nodes-same-config-persistent-queue-filling-only-in-one-of-them/350229/1 "2024-01-02T11:43:47Z")

</div>

Hello!

I have a 3 node Elasticsearch cluster, 2 Logstash nodes and about 100 filebeats sending data to Logstash. Every piece is 7.17  
Both Logstash nodes have the exact same configuration. There is a 16 GB persistent queue on each node.  
All Filebeats send data to both Logstash nodes using their internal Load Balancer (I mean all the filebeat.yml config files have this: loadbalance: true)  
Both Logstash nodes send data to all three Elasticsearch nodes, I mean everything is balanced  
When too many events arrive to Elasticsearch from Logstash (more than around 10 K events / sec), persistent queues are there to fill,  
**however only the node 1 persistent queue fills**  
Is this the expected behaviour? We upgraded from ELK 7.5 to 7.17, when we had 7.5 both queues filled.  
Both Logstash send events to Elasticsearch, and when events arrive slower, persistent queue drains

What could be wrong in my ELK Stack?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 2, 2024, 1:34pm UTC](https://discuss.elastic.co/t/two-logstash-nodes-same-config-persistent-queue-filling-only-in-one-of-them/350229/2 "2024-01-02T13:34:31Z")

</div>

Can you share your `filebeat.yml` ?

Also, which version of Filebeat are you using? Did you upgrade filebeat from 7.5 to 7.17 as well? What is the patch release of 7.17 that you are running?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 30, 2024, 1:35pm UTC](https://discuss.elastic.co/t/two-logstash-nodes-same-config-persistent-queue-filling-only-in-one-of-them/350229/3 "2024-01-30T13:35:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
