# Elastic search and logstash performance tuning

**URL:** <https://discuss.elastic.co/t/elastic-search-and-logstash-performance-tuning/169422>\
**Category:** Logstash\
**Created:** [February 21, 2019, 1:50pm UTC](https://discuss.elastic.co/t/elastic-search-and-logstash-performance-tuning/169422 "2019-02-21T13:50:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fadihaddad](https://avatars.discourse-cdn.com/v4/letter/f/4bbf92/32.png) [@fadihaddad](https://discuss.elastic.co/u/fadihaddad)\
**Post date:** [February 21, 2019, 1:50pm UTC](https://discuss.elastic.co/t/elastic-search-and-logstash-performance-tuning/169422/1 "2019-02-21T13:50:57Z")

</div>

hello, i have been using configuring logstash for tuning and i need help. i set the JVM heap of elasticsearch to 8gb and logstash JVM heap to 6gb  
my server has 4 cpus, 4 cores each 2.2ghz and 16gb RAM.  
i set the number of workers of logstash to 16 and batch size to 8000 and batch delay to 50  
300K events took like 3.45 mins. i noticed it is jumping to about 4800 events/s then falling back to 500- 900 . like in this picture

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/0/e/0eafed48450de8c6d6ae68e8bac544e753598907.png)

and here are stats from unix and metrics

 ![cpustat](https://us1.discourse-cdn.com/elastic/original/3X/0/5/0533cbeb2d57d6f7bf5e20bfc3f800cbe5407dd8.png)  
 ![iostAT](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa24dc00dec94589ccb9f58cfe7cb1e6babb4040.png)

 ![metrocs](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e553c9dbb6bfaa0c39ef3152d9e21e9668410f8.png)  
 ![network](https://us1.discourse-cdn.com/elastic/original/3X/7/d/7df0f76289f9f87017cca81e46f3b944191adb04.png)

can I keep the performance around 4800events/s or even more and I am running logstash and elasticsearch on the same node and here is mu logstash conf

input {

file {

path =\> "/data/elasticsearch/data/\*\_0004\_OCC.csv"

start\_position =\> "beginning"

sincedb\_path =\> "/dev/null"

}

}

filter {

csv {

separator =\> ","

columns =\>

["100 column headers"]

}

mutate {

add\_field =\> {

"Calldatetime" =\> "%{calldate} %{calltime}"

}

}

date {

match =\> ["Calldatetime", "YYYYMd HHmmss", "YYYYMdd HHmmss", "YYYYMMd HHmmss", "YYYYMMdd HHmmss"]

target =\> "Calldatetime"

locale =\> "en"

timezone =\> "UTC"

}

}

output {

stdout {

codec =\> dots

---

<div class="post-metadata">

**Author:** ![fadihaddad](https://avatars.discourse-cdn.com/v4/letter/f/4bbf92/32.png) [@fadihaddad](https://discuss.elastic.co/u/fadihaddad)\
**Post date:** [February 25, 2019, 9:32am UTC](https://discuss.elastic.co/t/elastic-search-and-logstash-performance-tuning/169422/2 "2019-02-25T09:32:37Z")

</div>

anyone?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2019, 9:33am UTC](https://discuss.elastic.co/t/elastic-search-and-logstash-performance-tuning/169422/3 "2019-03-25T09:33:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.