I've been tweaking the filebeat.yml for several hours now, and cannot get filebeat to use less CPU than 50~60%.
I have tried various combinations of:
filebeat.inputs: - type: log enabled: true include_lines: ['00-00001'] fields: app_id: ABCD-123 paths: - /apps/logs/urs*.log ignore_older: 10m # scan_frequency: 30s harvester_limit: 1 close_inactive: 10s
The directory beats is monitoring a directory that contains 1300 logs each being around 97MB. The logs rotate every minute (new 97MB log generates every minute).
I've tried under general, 1s ~ 5s:
Not sure what else to try.