Winlogbeat to Logstash Load Balancing and Failover

Elastic Stack Logstash
1

I have two logstash servers. Do I have to choose between load balancing between them all the time vs using one as a fail over?

For instance, if I am load balancing winlogbeat output and one of the logstash servers goes down, will winlogbeat automatically start sending all logs to the remaining logstash server?

The docs seem to imply that the fail over only happens when loadbalance is set to false.

2

There is not much to add besides what is already explained in the documentation.

If set to true and multiple Logstash hosts are configured, the output plugin load balances published events onto all Logstash hosts. If set to false, the output plugin sends all events to only one host (determined at random) and will switch to another host if the selected one becomes unresponsive. The default value is false.

If you set two or more logstash hosts, and do not set loadbalance: true, then it will pick one of the hosts at random and will only change if this host goes down.

If you set loadbalance: true it will then load balance the requests between all the configured hosts.

3

Thanks for the response @leandrojmp :slight_smile:

I understand that if loadbalance: false, then the output "will switch to another host if the selected one becomes unresponsive."

My question is if loadbalance: true, then will the output be routed to the available hosts if one or more of the hosts is unavailable?

4

Yes, if the request fails because one of the hosts went down, the batch will be retried on one of the other hosts.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.