Exist 43 child process of filebeat, is it normal?

Elastic Stack Beats
1

their is only one log file to ship (and this log file will logrotate by day) and send to kafka with 10 partitions , but have so many child process. Is it normal? why filebeat create so many child process?

pstree -p |grep filebeat
|-filebeat(46029)-+-{filebeat}(46033)
| |-{filebeat}(46034)
| |-{filebeat}(46035)
| |-{filebeat}(46036)
| |-{filebeat}(46037)
| |-{filebeat}(46038)
| |-{filebeat}(46039)
| |-{filebeat}(46040)
| |-{filebeat}(46041)
| |-{filebeat}(46042)
| |-{filebeat}(46043)
| |-{filebeat}(46044)
| |-{filebeat}(46045)
| |-{filebeat}(46046)
| |-{filebeat}(46047)
| |-{filebeat}(46048)
| |-{filebeat}(46049)
| |-{filebeat}(46050)
| |-{filebeat}(46051)
| |-{filebeat}(46052)
| |-{filebeat}(46053)
| |-{filebeat}(46054)
| |-{filebeat}(46055)
| |-{filebeat}(46056)
| |-{filebeat}(46057)

pstree -p |grep -c filebeat
43

2

What is ps aux | grep filebeat showing? Could it be that pstree also shows goroutines?

3

use ps aux | grep filebeat can only show one line .

It seems that their are too many child process, what about your filebeat?

4

filebeat is not creating any child processes. The go runtime creates a number of OS-threads, but no child processes. By using grep filebeat we can not tell the actual parent process though. You sure these are actual processes or are these threads? Can you try with ps only? Running ps -m should give you all threads, not just processes.

By default the go runtime requires GOMAXPROCS (environment variable) active OS-threads. If GOMAXPROCS is not set, the runtime will requires as many OS-threads as CPU cores are available (multiply by 2 if hyperthreading is enabled). The crux is in "active OS-Threads". If a blocking system call (like read from file) is executed within an OS-thread, it might be blocked. If the runtime is scheduling another go-routine it might start another OS-thread.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.