# Elastic Backpressure on Logstash?

**URL:** https://discuss.elastic.co/t/elastic-backpressure-on-logstash/191696
**Category:** Elasticsearch
**Created:** [July 22, 2019, 6:10pm UTC](https://discuss.elastic.co/t/elastic-backpressure-on-logstash/191696 "2019-07-22T18:10:16Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Jitendra\_Kumhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jitendra_kumhar/32/48640_2.png) [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)
#### Post date: [July 22, 2019, 6:10pm UTC](https://discuss.elastic.co/t/elastic-backpressure-on-logstash/191696/1 "2019-07-22T18:10:16Z")

</div>

I am sending data from various filebeats to two logstash machines and these machines send to ElasticSearch.  
When I monitored network it shows 12 MiB/minute receiving and 5 MiB/minute(because I am using http\_compression maybe) outgoing.  
I have persistent queue of 10 GB on logstash machine which gets filled very fast.  
I cant figure out why is this happening.  
So is this ElasticSearch back pressuring or something with logstash?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 22, 2019, 9:14pm UTC](https://discuss.elastic.co/t/elastic-backpressure-on-logstash/191696/2 "2019-07-22T21:14:00Z")

</div>

Logstash is only able to send data as fast as Elasticsearch can accept it, and it sounds like back-pressure is being applied. What is the specification of your Elasticsearch cluster?

---

<div class="post-metadata">

### Author: ![Jitendra\_Kumhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jitendra_kumhar/32/48640_2.png) [@Jitendra\_Kumhar](https://discuss.elastic.co/u/Jitendra_Kumhar)
#### Post date: [July 23, 2019, 6:17am UTC](https://discuss.elastic.co/t/elastic-backpressure-on-logstash/191696/3 "2019-07-23T06:17:43Z")

</div>

4 data nodes with 32 GB Ram and 2 master nodes with 4 GB Ram.  
I am sending to all 4 data nodes from logstash

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 23, 2019, 7:07am UTC](https://discuss.elastic.co/t/elastic-backpressure-on-logstash/191696/4 "2019-07-23T07:07:15Z")

</div>

How much CPU and what kind of storage? Local SSDs?

You should also always have at least 3 master eligible nodes in order to get a highly available cluster.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2019, 7:07am UTC](https://discuss.elastic.co/t/elastic-backpressure-on-logstash/191696/5 "2019-08-20T07:07:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
