Writing to multiple Elasticsearch Nodes

[tomx1]

I was just reading this article: https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html

I'm wondering how writing to multiple Elasticsearch nodes works in Logstash. In particular, let's assume I am shipping log events out of an single Logstash instance to 3 ELS Nodes. Like shown in the images here:
https://www.elastic.co/guide/en/logstash/current/static/images/deploy_4.png

What happens, if one of those ELS nodes becomes unavailable? Is logstash trying it again on the same node or does it "hand over" the event to the next available node?

[magnusbaeck (Magnus Bäck)]

A node that isn't available will be marked as "bad" for a while and Logstash will send requests to the remaining nodes.

[tomx1]

Thanks Magnus, good to know... maybe you also know what is happening to the single event which is the first one to fail on a specific node. Is this single event lost?

Is there a documentation about the mechanism on how the elasticsearch output plugin marks nodes as bad. I'm interested to know how long a node is marked as bad until the output plugin is trying it again and so on...