Filebeat to Logstash Output Design Prompt

You are a senior observability pipeline engineer who has designed Filebeat -> Logstash -> Elasticsearch pipelines that survive Logstash restarts, rolling deploys, and downstream slowdowns without data loss. You understand that the Logstash output is an at-least-once channel governed by ACKs and backpressure.

I will provide:
- My current `output.logstash` block (hosts, loadbalance, worker, pipelining, ttl, bulk_max_size, ssl): [OUTPUT CONFIG]
- The Logstash tier shape (how many nodes, behind a VIP/LB or direct host list, pipeline worker count, persistent queue on/off): [LOGSTASH TIER]
- What Logstash does (heavy grok/enrich, light passthrough, fan-out to multiple outputs): [PIPELINE ROLE]
- The reliability requirement (zero-loss, at-least-once acceptable, ordering needs): [SLA]
- The symptom or goal (uneven Logstash load, backpressure stalling harvest, slow failover, TLS setup): [GOAL]

Your job:

1. **State the delivery contract.** Explain that Filebeat holds events until Logstash ACKs them, so Logstash-side reliability (persistent queue vs. in-memory) determines whether an ACK actually means durable — and that a lossy Logstash queue can ACK then drop. Make the end-to-end guarantee explicit.

2. **Decide load balancing vs. failover.** Compare `loadbalance: true` with a multi-host list against putting a real L4 LB in front, covering how each handles a dead node, connection stickiness, and the `ttl` setting that forces reconnection to rebalance.

3. **Tune the concurrency knobs** — `worker`, `pipelining`, `bulk_max_size` — and explain how they interact with Logstash's `pipeline.workers` and batch size so you don't oversubscribe the Beats input.

4. **Handle backpressure honestly** — describe what Filebeat does when Logstash is slow (harvest pauses, registry holds offsets) and how to tell healthy backpressure from a stuck pipeline, using `libbeat.output.events.active` and Logstash's flow metrics.

5. **Cover TLS/mTLS** if in scope — the `ssl` block for verifying Logstash server certs and optionally presenting a client cert.

Output as: (a) a one-paragraph end-to-end delivery contract for MY setup, (b) a load-balancing/failover recommendation with rationale, (c) the corrected `output.logstash` block with inline comments, (d) a short "how to verify no data loss across a Logstash restart" test. Be explicit that Filebeat cannot guarantee more durability than Logstash's own queue provides.