Diagnose high CPU usage of beats deployed by Agent

Elastic Stack Beats
1

I'm testing fleet and I have noticed that filebeat and metricbeat use quite a few CPU cycles. I'm using the Windows, System and IIS integrations, and on an 8 vcpu VM, filebeat consistently consumes 20%. Metricbeat consumes anywhere from 5% - 15% on the same machine. Is this normal? These CPUs are a bit older (Intel xeon v2) but I feel that the usage is more than it should be. Is there any way to maybe customize how often filebeat collects logs? I left all the defaults in place for everything for those integrations (some items in metricbeat are at 10s, some at 1m).

On Linux, I'm also seeing higher CPU usage than I would hope for from filebeat deployed via the agent.

2

I wanted to follow up and say that at least on one of the machines I was monitoring this on, filebeat magically cleaned up its act. See the following graph of CPU over time for metricbeat and filebeat:

image
image1103×538 30.6 KB

3

Without seeing your filebeat or metricbeat config, it is impossible to know what is it going on. You can use strace in Linux to find out what system calls it is using that is causing the high utilization, however.