100% CPU with Logstash 1.5.x

Elastic Stack Logstash
1

good afternoon all.

I am running the RPM version of logstash on Centos 7. It was working great untill I started having errors. I upgraded to the 1.5.3 package. It relieved the other issue, but it is now running at 100% CPU it is a dual quad core Xeon with 48GB of ram. Would anyone know where to start looking?

Thanks,

2

Posting your config would help :slight_smile:

3

Here it is

input {
lumberjack {
port => 5000
type => "syslog"
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}

tcp {
type	=> 'powershell-json'
port	=> 3519
codec	=> json {
	charset => 'UTF-8'
}

}

tcp {
    type   => "eventlog"
    port   => 3515
    codec  => json_lines
}

tcp {
    type => "iislog"
    port => 3516
    codec => json_lines

}
udp {
type => "Exchange"
port => 5141
}
tcp {
type => "apache"
port => 3517
}

udp {
type => "loadbalancer"
port => 3518
}

file {
path => "/upload/bluecoatlogs/SG*.log"
type => "bluecoat"
start_position => "beginning"
}

}

output {

elasticsearch {
protocol => "transport"
host => localhost }

}

**

4

What java version are you running?

5

It turns out that it was my configuration. It was reprocessing a very large file everytime that I would restart.