Elapsed filter and performance

Elastic Stack Logstash
1

Hi,

I'm using elapsed filter to do the math between the time a event start and a event end.
This occur between 2 documents, like the elapsed filter work.
The problem is that i only can have 1 worker treating all the messages, in this case from a JMS input, to ensure that all the events is processed in sequence.
By default the logstash have 8 workers, but i can't used them and this is a problem because this is slower.

This is the behavior that you guys experience? Can i make something different?
Can i have the >1 workers to calculate the elapsed time the event occur?

Cheers,

2

You can use more than one worker thread (the filter using a mutex to synchronize access to its data) but as soon as you have more than one thread then, as you note, you lose control of the order in which events are processed, so you risk the end event being processed before the start event.

3

Yeap that's exactly what i've experience. The End event process before the start event and the end event can figured out where the event started and return timeout.

So what you are saying is if i want the elapsed field, i must realize that "there could be only one" worker.

4

Yes.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.