I try to set up logstash to receive a large number of UDP messages per second, up to may be 50k. Currently, for my test setup, logstash and elasticsearch is installed on my local machine (i5-4590S, 16gb RAM) and gets messages from 3 different VMs on 3 different ports through UDP messages.
The UDP messages contain one of 6 different log messages which get parsed by one of 6 config files with the use of grok patterns.
I start logstash with -w 16 and -b 1564. However, the messages I receive in elasticsearch cap out at 5.6k messages/second without any filters applied. With filters, they capout at about 4.8k. CPU usage on all cores is around 50 to 80% and memory usage is only 4.3gb out of my 16gb.
What do you guys think would be the best approach to handle that many messages/second with ELK?