# Filebeat 7.3.0 High CPU

**URL:** https://discuss.elastic.co/t/filebeat-7-3-0-high-cpu/260130
**Category:** Beats
**Tags:** filebeat
**Created:** [January 4, 2021, 8:47pm UTC](https://discuss.elastic.co/t/filebeat-7-3-0-high-cpu/260130 "2021-01-04T20:47:55Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![tarpanpathak](https://avatars.discourse-cdn.com/v4/letter/t/0ea827/32.png) [@tarpanpathak](https://discuss.elastic.co/u/tarpanpathak)
#### Post date: [January 4, 2021, 8:47pm UTC](https://discuss.elastic.co/t/filebeat-7-3-0-high-cpu/260130/1 "2021-01-04T20:47:55Z")

</div>

Hi,

I am not sure if this is the best place to discuss this but one of our compute nodes in Kubernetes is constantly alerting on high CPU. After digging a bit deeper, we see that the Filebeat process on the node is triggering the alert. Here are some configuration and metrics:

Filebeat version: 7.0.1  
Filebeat configuration with sensitive information redacted:

```auto
image:
  repository: docker.elastic.co/beats/filebeat-oss
  tag: 7.3.0
  pullPolicy: IfNotPresent

config:
  logging.json: true
  filebeat.config:
    filebeat.autodiscover:
      providers:
       - type: kubernetes
         hints.enabled: true

  filebeat.inputs:
    - type: log
      enabled: true
      paths:
        - /var/log/*.log
        - /var/log/messages
        - /var/log/syslog
    - type: docker
      json.keys_under_root: false
      json.add_error_key: true
      containers.ids:
        - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true
        - drop_event:
            when:
              equals:
                kubernetes.container.name: "filebeat"

  # Disable automatic ILM, since we already manage it separately
  setup:
    ilm:
      enabled: false

    template:
      name: "<template_name>"
      pattern: "<pattern>"

  output:
    elasticsearch:
      hosts: ["<elasticsearch_endpoint>"]
      username: "<username>"
      # password: "set me through --set config.output.elasticsearch.password=XYZ"
      enable: true
      bulk_max_size: 1000
      index: "<index>"
      indices:
        - index: "<index>"
      path: "/"

  output.file:
      enabled: false

  http.enabled: false

monitoring:
  enabled: false

```

We've not made any changes to Filebeat itself recently. Additionally, the Filebeat logs do not hint at the underlying issue. What else can we look at to figure out a root case for the high CPU alert/s? As an additional debugging step, I did look at the following documents but am not sure if they are relevant:

- [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-cpu.html#:~:text=Filebeat%20is%20using%20too%20much%20CPUedit,disk%20in%20a%20tight%20loop](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-cpu.html#:~:text=Filebeat%20is%20using%20too%20much%20CPUedit,disk%20in%20a%20tight%20loop)
- [Filebeat is using too much cpu](https://discuss.elastic.co/t/filebeat-is-using-too-much-cpu/187978)
- [Filebeat Consumes High CPU:](https://discuss.elastic.co/t/filebeat-consumes-high-cpu/127000)
- [Filebeat CPU usage too high](https://discuss.elastic.co/t/filebeat-cpu-usage-too-high/200782)

I am happy to provide additional details as needed so any help would be greatly appreciated.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 1, 2021, 10:48pm UTC](https://discuss.elastic.co/t/filebeat-7-3-0-high-cpu/260130/2 "2021-02-01T22:48:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.