From a Beats perspective Logstash seems to be built to be a single node application at a first glance. By tweaking its configuration, it is possible to have a load-balanced installation having multiple hosts with logstash that can be behind a load-balancer.
In my problem I have multiple hosts generating logs across the globe, and our existing design consisted of one Logstash instance per region. Though managing this setup was quite possible with ansible, it’s expensive and at the same time not failsafe (if an instance crashes in a region the logs won’t be transferred in time)
So, we had…
