Benchmarking Filebeats

Elastic Stack Beats
1

As explained in this post I enabled my filebeat with very simple configurations as startup.

filebeat.prospectors:
- input_type: log
  paths:
    - /root/*.log
  ignore_older: 5m
  scan_frequency: 10s
  close_inactive: 10m
output.kafka:
  hosts: ["172.16.23.27:9092"]
  topic: prem

After I run ./filebeat -c filebeat.kafka.yml -httpprof :6060

Then I am running the expvar_rates.py. But its showing error and I cannot get any result. I am using 5.2.2 filebeat, 0.9 kafka & 2.7 python.

Traceback (most recent call last): File "expvar_rates.py", line 64, in <module> main() File "expvar_rates.py", line 31, in main json = r.json() File "/usr/lib/python2.6/site-packages/requests/models.py", line 866, in json return complexjson.loads(self.text, **kwargs) File "/usr/lib64/python2.6/site-packages/simplejson/__init__.py", line 307, in loads return _default_decoder.decode(s) File "/usr/lib64/python2.6/site-packages/simplejson/decoder.py", line 338, in decode raise ValueError(errmsg("Extra data", s, end, len(s))) ValueError: Extra data: line 1 column 4 - line 2 column 1 (char 4 - 19)

2

What command do you use to start the expvar_rates.py script? Is this the version that you use?

3

I copied my script from the same mentioned link.

4

The error seems to indicate that the server returns invalid JSON. Can you do a curl http://localhost:6060/debug/vars and check that the answer looks valid?

5

I am getting one big JSON. But how can I say that its valid are not???

6

Some of the intresting counters.. Cant paste total object (too big)

   "filebeat.harvester.closed": 5,
    "filebeat.harvester.open_files": 2,
      "filebeat.harvester.running": 2,
      "libbeat.kafka.call_count.PublishEvents": 7738,
      "libbeat.kafka.published_and_acked_events": 9188705,
     "libbeat.publisher.published_events": 9189729,
7

Thanks your version is working for me. But can you explain that

Is this the count my beat is pushing

publish.events: 34595.7300882/s (avg: 29292.9529271/s) (total: 7473152)

8

Yes, it seems to be able to push around 30 K/s.

9

For me this is enough. But its using 200% (complete 2 cores) in 8 core server. Can I able to reduce this cpu consumption. I am using all default configurations only.

10

If you want, you can restrict it to a single core by using the GOMAXPROCS env variable, but the throughput will likely go down. From our benchmarks, most of the time is spent in JSON encoding, and we are looking for ways to improve that.

If you are curious, you can do your own profile by using the -httpprof option.

11

Can you please explain how to do my own profiling using this -httpprof?? It will help us a lot

12

These two links should help:

2 Likes
13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.