# Elasticsearch and overload

**URL:** <https://discuss.elastic.co/t/elasticsearch-and-overload/216700>\
**Category:** Elasticsearch\
**Created:** [January 27, 2020, 4:51pm UTC](https://discuss.elastic.co/t/elasticsearch-and-overload/216700 "2020-01-27T16:51:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [January 27, 2020, 4:51pm UTC](https://discuss.elastic.co/t/elasticsearch-and-overload/216700/1 "2020-01-27T16:51:27Z")

</div>

Hello, our Elasticsearch cluster is used to store a variety of logs including Windows domain controller logs; I noticed that since adding Cisco netflow logs (which was over a million events ever 15 minutes) Elasticsearch now seems to be collecting much few domain controller logs.

Is Elasticsearch 'overloaded' and what would be the signs of that?

---

<div class="post-metadata">

**Author:** ![SpeedDaemon](https://avatars.discourse-cdn.com/v4/letter/s/4af34b/32.png) [@SpeedDaemon](https://discuss.elastic.co/u/SpeedDaemon)\
**Post date:** [January 27, 2020, 5:18pm UTC](https://discuss.elastic.co/t/elasticsearch-and-overload/216700/2 "2020-01-27T17:18:59Z")

</div>

> [@kernelpanic](#):
>
> Hello, our Elasticsearch cluster is used to store a variety of logs including Windows domain controller logs; I noticed that since adding Cisco netflow logs (which was over a million events ever 15 minutes) Elasticsearch now seems to be collecting much few domain controller logs.
> 
> Is Elasticsearch 'overloaded' and what would be the signs of that?

How are the logs getting into elasticsearch? Do you have any kind of queuing in front of it that you could check the status of?

In the cases where my cluster couldn't keep up, I had similar symptoms ("missing" events that were still queued in Logstash until it got caught up).

---

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [January 27, 2020, 6:13pm UTC](https://discuss.elastic.co/t/elasticsearch-and-overload/216700/3 "2020-01-27T18:13:43Z")

</div>

Thanks for the reply SpeedDaemon - there are two Logstash servers, the Windows domain controller logs go through one and the Cisco firewall / netflow logs go through the other.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2020, 6:13pm UTC](https://discuss.elastic.co/t/elasticsearch-and-overload/216700/4 "2020-02-24T18:13:45Z")

</div>

Closed on February 24, 2020, 6:13pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.