How to enable Filebeat load balancing for Logstash output

Shipping every event to one Logstash endpoint makes log delivery depend on a single TCP path, one listener, and one maintenance window. Enabling load balancing in Filebeat keeps publishing active across more than one Logstash host so ingest can continue when one endpoint is restarted or temporarily unreachable.

The output.logstash block opens lumberjack-over-TCP connections to the hosts listed in /etc/filebeat/filebeat.yml. With loadbalance: true, current Filebeat releases publish across every configured host in parallel instead of selecting one host at random, and worker or workers increases the number of publishing connections created for each host.

Each listed Logstash endpoint must expose the same beats input and accept the same authentication and TLS settings, or some connections will fail while others succeed. This workflow assumes a packaged Linux install with the main config at /etc/filebeat/filebeat.yml and a systemd service named filebeat. Current Filebeat docs keep loadbalance disabled by default for the Logstash output, so setting it explicitly avoids ambiguity when old examples or inherited configs are involved.

Steps to enable Filebeat load balancing for Logstash output:

Open the Filebeat configuration file.
```
$ sudo nano /etc/filebeat/filebeat.yml
```
YAML indentation is significant; keep nested keys aligned and use spaces instead of tabs.
Update the existing Logstash output block to use multiple hosts and enable load balancing.
```
output.logstash:
  hosts:
    - "logstash-1.example.net:5044"
    - "logstash-2.example.net:5044"
  loadbalance: true
  worker: 2
```
Only one output.* block can be enabled in /etc/filebeat/filebeat.yml. If the system is not already using Logstash output, switch it first. Related: How to configure Filebeat output to Logstash

Keep existing ssl.*, proxy_*, and authentication settings in the same output.logstash block so every listed host uses identical transport settings. Current Filebeat docs accept both worker and workers; use one style consistently.

worker: 2 with two hosts creates four publishing connections. Current builds also show each host once per worker in filebeat test output and startup logs.
Test the configuration syntax before restarting the service.
```
$ sudo filebeat test config -c /etc/filebeat/filebeat.yml
Config OK
```
Related: How to test a Filebeat configuration

Test the saved Logstash output settings against every configured host.

$ sudo filebeat test output -c /etc/filebeat/filebeat.yml
logstash: logstash-1.example.net:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.0.2.21
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... OK
logstash: logstash-1.example.net:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.0.2.21
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... OK
logstash: logstash-2.example.net:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.0.2.22
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... OK
logstash: logstash-2.example.net:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.0.2.22
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... OK

With worker: 2, current Filebeat releases repeat each host once per connection in the output test. Seeing successful talk to server... OK lines for both hosts confirms the saved configuration can reach every endpoint. Related: How to test Filebeat output connectivity

Restart the Filebeat service to apply the updated output settings.
```
$ sudo systemctl restart filebeat
```
Related: How to manage the Filebeat service with systemctl in Linux
Confirm the service returned to an active state.
```
$ sudo systemctl is-active filebeat
active
```
If the command returns failed or inactive, inspect the full service status and journal output before retrying the restart. Related: How to manage the Filebeat service with systemctl in Linux

Review recent Filebeat logs for established connections to both Logstash hosts.

$ sudo journalctl --unit=filebeat --no-pager --grep 'Connection to backoff' --lines=8
Apr 02 12:15:20 loghost01 filebeat[3427]: {"log.level":"info","@timestamp":"2026-04-02T12:15:20.083Z","log.logger":"publisher_pipeline_output","message":"Connection to backoff(async(tcp://logstash-1.example.net:5044)) established","service.name":"filebeat","ecs.version":"1.6.0"}
Apr 02 12:15:20 loghost01 filebeat[3427]: {"log.level":"info","@timestamp":"2026-04-02T12:15:20.083Z","log.logger":"publisher_pipeline_output","message":"Connection to backoff(async(tcp://logstash-1.example.net:5044)) established","service.name":"filebeat","ecs.version":"1.6.0"}
Apr 02 12:15:20 loghost01 filebeat[3427]: {"log.level":"info","@timestamp":"2026-04-02T12:15:20.086Z","log.logger":"publisher_pipeline_output","message":"Connection to backoff(async(tcp://logstash-2.example.net:5044)) established","service.name":"filebeat","ecs.version":"1.6.0"}
Apr 02 12:15:20 loghost01 filebeat[3427]: {"log.level":"info","@timestamp":"2026-04-02T12:15:20.088Z","log.logger":"publisher_pipeline_output","message":"Connection to backoff(async(tcp://logstash-2.example.net:5044)) established","service.name":"filebeat","ecs.version":"1.6.0"}

With more than one worker, duplicate established lines for the same host are expected because Filebeat logs each connection separately. If only one host appears, recheck the host list, the Logstash beats input listener, firewalls, and any host-specific certificate or authentication mismatch.