# Filebeat 6.3.0 is taking too much of memory on windows 2008R2
**URL:** https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715
**Category:** Beats
**Created:** [July 26, 2018, 8:24am UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715 "2018-07-26T08:24:27Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Junble](https://discuss.elastic.co/u/Junble)
#### Post date: [July 26, 2018, 8:24am UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/1 "2018-07-26T08:24:28Z")
hi:
I've set up a filebeat service（version 6.3.0） running on windows2008 R2.
I found the memory has gone up all the time
Does filebeat have potential memory leaks?
Rotated file：
filebeat.yml:
queue.mem:
events: 8192
flush.min\_events: 2048
flush.timeout: 2s
scan\_frequency: 1
close\_eof: true
harvester\_buffer\_size: 163840
output.kafka:
hosts: ["10.129.236.83:9093", "10.129.236.118:9093", "10.129.236.137:9093"]
topic: 'FilebeatTest'
partition.round\_robin:
reachable\_only: false
required\_acks: 1
compression: none
max\_message\_bytes: 1000000
work: 4
bulk\_max\_size: 20480
channel\_buffer\_size: 256000
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [July 26, 2018, 2:17pm UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/2 "2018-07-26T14:17:58Z")
Hello @Junble,
I did a quick dive into the code to know where the values are coming from.
**Process Total** is the _total allocated_ memory over time.
```auto
// TotalAlloc is cumulative bytes allocated for heap objects.
//
// TotalAlloc increases as heap objects are allocated, but
// unlike Alloc and HeapAlloc, it does not decrease when
// objects are freed.
```
**Note it does not decrease when object are freed.**
Active is _Alloc_.
```auto
// Alloc is bytes of allocated heap objects.
//
// This is the same as HeapAlloc (see below).
Alloc uint64
```
If you use a tool like [process explorer](https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer) you will get a bit more information about the actual memory of the process.
So I don't think there is a leak, but I do believe the value of "Process total" is a bit confusing.
---
### Author:  [@Junble](https://discuss.elastic.co/u/Junble)
#### Post date: [July 27, 2018, 7:11am UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/3 "2018-07-27T07:11:55Z")
Hello @pierhugues,
uptime a day, Filebeat.exe :
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [July 27, 2018, 1:20pm UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/4 "2018-07-27T13:20:12Z")
@Junble This is a lot of physical memory.
Is the process crashes at some point or the memory keep growing?
I am looking at your configuration and I am trying to understand where the memory goes.
I see a lot of options that diverge from the default configuration that could potentially increase the memory usage. The options can increase performance but its at the price of increased memory usage.
I would like to see the memory usage from a default configuration so have something to compare with.
**queue.mem.events** , this option is the maximum of events in memory, default is _4096_, your values _8196_.
**harvester\_buffer\_size** , This is the buffer read size from the harvester, default is _16384_ your value is 163840
**output.kafka.bulk\_max\_size** , This is the maximum bulk size , default is _2048_ your value is 20480
**channel\_buffer\_size** , Per Kafka broker number of messages buffered in output pipeline. The default is _256_, your value is 256000.
The _channel\_buffer\_size_ this is a really high value vs the default, can you revert the options above to their default values and report the memory usage?
---
### Author:  [@Junble](https://discuss.elastic.co/u/Junble)
#### Post date: [July 31, 2018, 3:49am UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/5 "2018-07-31T03:49:13Z")
Hi @pierhugues
Thank you !
Sorry for my late reply.
I have been sick these days.
No crash，all memory has been used！
I'm going to do the other test as you say!
---
### Author:  [@Junble](https://discuss.elastic.co/u/Junble)
#### Post date: [July 31, 2018, 11:55am UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/6 "2018-07-31T11:55:33Z")
Hi, @pierhugues
**By default values ,the same result :**
**pprof result** :
**inuse\_space or alloc\_objects， memory is going up all the time**!
1：go tool pprof **--inuse\_space** [http://127.0.0.1:6060/debug/pprof/heap](http://127.0.0.1:6060/debug/pprof/heap)
2：go tool pprof **--alloc\_objects** [http://127.0.0.1:6060/debug/pprof/heap](http://127.0.0.1:6060/debug/pprof/heap)
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [July 31, 2018, 7:52pm UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/7 "2018-07-31T19:52:59Z")
Hello @Junble Can you start Filebeat using the built in http profiler? The command will look like this:
```auto
./filebeat -httpprof localhost:6060
```
let it run for a good amount of time and use your browser to go to the url `http://localhost:6060/debug/pprof/heap` and attach the heap dump here. I will be able to play with it.
We have an open PR for a goroutine leak, but I don't know if it's the same problem as you.
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [July 31, 2018, 8:05pm UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/8 "2018-07-31T20:05:03Z")
After talking with @adrisr it look like to be this issue [https://github.com/elastic/beats/pull/7820](https://github.com/elastic/beats/pull/7820)
it should be fixed in the next release
---
### Author:  [@Junble](https://discuss.elastic.co/u/Junble)
#### Post date: [August 1, 2018, 5:01pm UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/9 "2018-08-01T17:01:07Z")
Hello, @pierhugues
**Thank you very much!
Thank you messages for team members!
All the best messages，looking forward to the next updates.**
**My test scenario is the producer have been creating files:**
**One harvester is started for each file, there's a lot of harvesters**
**That's what I did,started Filebeat with command:** _. /filebeat -httpprof localhost:6060_
**But use my browser to go to the url:** _[http://localhost:6060/debug/pprof/heap](http://localhost:6060/debug/pprof/heap)_
**Unreadable code ,what do I need to install?**
**Uptime a day ,the result:**
---
### Author:  [@Junble](https://discuss.elastic.co/u/Junble)
#### Post date: [August 7, 2018, 11:50am UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/10 "2018-08-07T11:50:36Z")
Hello @pierhugues @adrisr
Up time 31h, I got it, the heap.gz download url :
[https://drive.google.com/open?id=1o1OYJ-BHIMbEMHsgCigi2Zx5GGhkt\_RF](https://drive.google.com/open?id=1o1OYJ-BHIMbEMHsgCigi2Zx5GGhkt_RF)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 4, 2018, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715/11 "2018-09-04T13:50:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.