How to enable Filebeat load balancing for Logstash output

Shipping logs to a single Logstash node makes ingestion reliability hinge on one host, one network path, and one maintenance window. Enabling Filebeat load balancing spreads event publishing across multiple endpoints to keep pipelines flowing during outages and to prevent one node from becoming a single point of disappointment.

The Filebeat output.logstash output maintains TCP connections to one or more Logstash hosts that run the Beats input plugin (commonly on port 5044). With multiple hosts defined, loadbalance: true keeps connections open to each endpoint and distributes publish batches across them, while worker increases parallel publishers per host for higher throughput.

All configured Logstash endpoints must accept the same authentication and TLS settings (CA chain, client certificates, credentials) or some connections will fail and trigger backoff retries. Load balancing also changes event ordering and can increase the number of open connections, so keep pipeline assumptions simple and tune worker conservatively. YAML indentation in /etc/filebeat/filebeat.yml is strict, and only one Filebeat output can be enabled at a time.

1. Open the Filebeat configuration file.

   $ sudo nano /etc/filebeat/filebeat.yml

   YAML indentation is significant; use spaces and keep nested keys aligned.

2. Configure the Logstash output with multiple hosts.

   output.logstash:
     hosts: ["logstash-1.example.net:5044", "logstash-2.example.net:5044"]
     loadbalance: true
     worker: 2

   Only one Filebeat output can be enabled; comment out any other output.* blocks to avoid startup errors.

   loadbalance publishes across all configured hosts; worker opens additional parallel connections per host for higher throughput.

   Each worker creates a separate TCP connection per host; worker: 2 with two hosts results in four concurrent connections.

   Related: How to configure Filebeat output to Logstash

3. Test the configuration for errors.

   $ sudo filebeat test config -c /etc/filebeat/filebeat.yml
   Config OK

   Related: How to test a Filebeat configuration

4. Restart the Filebeat service.

   $ sudo systemctl restart filebeat

   Related: How to manage the Filebeat service with systemctl in Linux

5. Confirm the Filebeat service is running after the restart.

   $ sudo systemctl status filebeat --no-pager --lines=15
   ● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
        Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; preset: enabled)
       Drop-In: /etc/systemd/system/filebeat.service.d
                └─env.conf
        Active: active (running) since Wed 2026-01-07 04:43:32 UTC; 20s ago
          Docs: https://www.elastic.co/beats/filebeat
   ##### snipped #####

6. Review Filebeat logs for connection lines to each Logstash endpoint.

   $ sudo journalctl --unit=filebeat --no-pager --lines=30
   Jan 07 04:43:42 host filebeat[15881]: {"log.level":"info","@timestamp":"2026-01-07T04:43:42.288Z","log.logger":"publisher_pipeline_output","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run","file.name":"pipeline/client_worker.go","file.line":146},"message":"Connection to backoff(async(tcp://logstash-2.example.net:5044)) established","service.name":"filebeat","ecs.version":"1.6.0"}
   Jan 07 04:43:42 host filebeat[15881]: {"log.level":"info","@timestamp":"2026-01-07T04:43:42.289Z","log.logger":"publisher_pipeline_output","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run","file.name":"pipeline/client_worker.go","file.line":146},"message":"Connection to backoff(async(tcp://logstash-1.example.net:5044)) established","service.name":"filebeat","ecs.version":"1.6.0"}
   ##### snipped #####

   Connection established lines for each host indicate active load-balanced connections.