# Filebeat 7.3.2 using high CPU (50~60%)

**URL:** https://discuss.elastic.co/t/filebeat-7-3-2-using-high-cpu-50-60/240251
**Category:** Beats
**Tags:** filebeat
**Created:** [July 8, 2020, 2:41am UTC](https://discuss.elastic.co/t/filebeat-7-3-2-using-high-cpu-50-60/240251 "2020-07-08T02:41:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![tandav](https://avatars.discourse-cdn.com/v4/letter/t/a698b9/32.png) [@tandav](https://discuss.elastic.co/u/tandav)
#### Post date: [July 8, 2020, 2:41am UTC](https://discuss.elastic.co/t/filebeat-7-3-2-using-high-cpu-50-60/240251/1 "2020-07-08T02:41:31Z")

</div>

Hello community.

I've been tweaking the filebeat.yml for several hours now, and cannot get filebeat to use less CPU than 50~60%.

I have tried various combinations of:

```auto
    filebeat.inputs:

     - type: log
       enabled: true
       include_lines: ['00-00001']
       fields:
         app_id: ABCD-123
       paths:
         - /apps/logs/urs*.log

       ignore_older: 10m
    # scan_frequency: 30s
       harvester_limit: 1
       close_inactive: 10s

```

The directory beats is monitoring a directory that contains 1300 logs each being around 97MB. The logs rotate every minute (new 97MB log generates every minute).

I've tried under general, 1s ~ 5s:

`filebeat.registry.flush: 5s`

Not sure what else to try.

Thanks.

---

<div class="post-metadata">

### Author: ![tandav](https://avatars.discourse-cdn.com/v4/letter/t/a698b9/32.png) [@tandav](https://discuss.elastic.co/u/tandav)
#### Post date: [July 10, 2020, 2:28pm UTC](https://discuss.elastic.co/t/filebeat-7-3-2-using-high-cpu-50-60/240251/2 "2020-07-10T14:28:55Z")

</div>

Any thoughts @steffens?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 7, 2020, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-7-3-2-using-high-cpu-50-60/240251/3 "2020-08-07T16:29:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.