# Beats-pipeline.conf Spikes CPU 100% w/2+ outputs

**URL:** <https://discuss.elastic.co/t/beats-pipeline-conf-spikes-cpu-100-w-2-outputs/122909>\
**Category:** Logstash\
**Created:** [March 7, 2018, 3:31pm UTC](https://discuss.elastic.co/t/beats-pipeline-conf-spikes-cpu-100-w-2-outputs/122909 "2018-03-07T15:31:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\
**Post date:** [March 7, 2018, 3:31pm UTC](https://discuss.elastic.co/t/beats-pipeline-conf-spikes-cpu-100-w-2-outputs/122909/1 "2018-03-07T15:31:36Z")

</div>

Hi,  
Outside of the individual performance of the targets I haven't seen any examples like this. Doesn't seem to matter which output I use as long as I only use one so I don't feel target performance is the issue and I may have a yml format problem with what is posted below.

I don't see how I could solve this in a pipeline either.

**Q: Are multiple output supported in a single pipeline or could someone add an example or reference one in Documentation?**

Thanks !

input {  
beats {  
port =\> 5044  
}  
}

output{  
elasticsearch {  
hosts =\> "elasticsearch.svr:9200"  
sniffing =\> false  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
} # End elasticsearch

```
  if [type]=="wineventlog" and [level] == "Error" or [level] == "Warning" {
    http {
    user=>"apiusername"
    password=>"#########"
    http_method=>"post"
    format=>"message"
    content_type => "application/json"
    url=>"http://monitoring.svr/api/alert"
    #message =>'{"message":"%{name} %{log_name}"}'
    message =>'{"aligned_resource":"/device/5013","message":"%{host} %{log_name} %{level} EventID:%{event_id} %{message}"}'
    } # End http
  } # End if

  if [type]=="wineventlog" {
    sumologic {
    url => "https://endpoint1.collection.us2.sumologic.com/""
    compress => true
    compress_encoding => "gzip"
    source_name => "%{host}"
    source_category => "windows"
    format => "%{@timestamp} %{@json}"
    } # End Sumo
  } # End if

```

} # End Out

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 10, 2018, 8:36pm UTC](https://discuss.elastic.co/t/beats-pipeline-conf-spikes-cpu-100-w-2-outputs/122909/2 "2018-03-10T20:36:16Z")

</div>

You can have multiple outputs in the same pipeline, with the caveat that if one output isn't able to process events it'll stall the whole pipeline and prevent events from being sent to the rest of the outputs.

---

<div class="post-metadata">

**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\
**Post date:** [March 13, 2018, 11:30am UTC](https://discuss.elastic.co/t/beats-pipeline-conf-spikes-cpu-100-w-2-outputs/122909/3 "2018-03-13T11:30:15Z")

</div>

Issue seems to have been fixed by tuning the SumoLogic output.  
automatic\_retries =\> 10  
validate\_after\_inactivity =\> 3  
request\_timeout =\> 10

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2018, 11:30am UTC](https://discuss.elastic.co/t/beats-pipeline-conf-spikes-cpu-100-w-2-outputs/122909/4 "2018-04-10T11:30:29Z")

</div>

Closed on April 10, 2018, 11:30am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.