# Winlogbeat to Logstash Load Balancing and Failover

**URL:** https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902
**Category:** Logstash
**Created:** [November 10, 2021, 2:54pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902 "2021-11-10T14:54:19Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![6igwig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6igwig/32/88971_2.png) [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [November 10, 2021, 2:54pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902/1 "2021-11-10T14:54:19Z")

</div>

I have two logstash servers. Do I have to choose between load balancing between them all the time vs using one as a fail over?

For instance, if I am load balancing winlogbeat output and one of the logstash servers goes down, will winlogbeat automatically start sending all logs to the remaining logstash server?

The [docs](https://www.elastic.co/guide/en/beats/winlogbeat/6.8/logstash-output.html#loadbalance) seem to imply that the fail over only happens when loadbalance is set to false.

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 10, 2021, 4:12pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902/2 "2021-11-10T16:12:19Z")

</div>

There is not much to add besides what is already explained in the documentation.

> If set to true and multiple Logstash hosts are configured, the output plugin load balances published events onto all Logstash hosts. If set to false, the output plugin sends all events to only one host (determined at random) and will switch to another host if the selected one becomes unresponsive. The default value is false.

If you set two or more logstash hosts, and do not set `loadbalance: true`, then it will pick one of the hosts at random and will only change if this host goes down.

If you set `loadbalance: true` it will then load balance the requests between all the configured hosts.

---

<div class="post-metadata">

### Author: ![6igwig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6igwig/32/88971_2.png) [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [November 10, 2021, 6:09pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902/3 "2021-11-10T18:09:20Z")

</div>

Thanks for the response @leandrojmp 🙂

I understand that if `loadbalance: false`, then the output "will switch to another host if the selected one becomes unresponsive."

My question is if `loadbalance: true`, then will the output be routed to the available hosts if one or more of the hosts is unavailable?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 10, 2021, 7:41pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902/4 "2021-11-10T19:41:34Z")

</div>

Yes, if the request fails because one of the hosts went down, the batch will be retried on one of the other hosts.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 8, 2021, 7:41pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902/5 "2021-12-08T19:41:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
