# Filebeat can't keep up with single log file **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 22, 2018, 7:08am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979 "2018-06-22T07:08:34Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![JensVanDeynse](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Post date:** [June 22, 2018, 7:08am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/1 "2018-06-22T07:08:34Z")
Hello Logstash version: 6.2.4 Filebeat version: 6.2.4 We've setup an ELK stack in our company but recently we've been experiencing some issues during the morning ramp-up on our filebeats. The problem is as follows: Filebeat can't keep up with the logs, at least that's what I can see in the monitoring, initially it's sending above 500 events per second but when this value should increase because the logs increase it starts to decline to a value between 200 & 0 events per second. I tried looking at some configuration options but the only thing I could find is when there are multiple files but in this case there's only one file (haproxy.log) so I can't increase the scan\_frequency or other similar options. This is the current filebeat configuration: # HAProxy logs - type: log paths: - /var/log/haproxy.log fields: env: prod host: lb01.careconnect.be app: haproxy document\_type: haproxy fields\_under\_root: true Is there any other configuration option of filebeat that I can use to fix this issue? Thank you for your help ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 22, 2018, 7:10am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/2 "2018-06-22T07:10:47Z")
Filebeat can only send data as fast as the downstream systems can accept it. what does your ingest architecture look like? Are you sending data to Elasticsearch? If so, what is the specification of your Elasticsearch cluster? ---
**Author:** ![JensVanDeynse](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Post date:** [June 22, 2018, 7:16am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/3 "2018-06-22T07:16:48Z")
No, everything is being sent to a logstash server which then parses the logs This is one logstash server with 10 CPU cores and 8GB of memory, i've assigned 48 (too much but still no issues) pipeline workers to the machine and a JVM Heap of 4GB. Initially I thought this was a logstash issue but the problem is that nor the JVM heap usage is more than 75% and the CPU is never used over 50% Is there any more information that can help? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 22, 2018, 7:33am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/4 "2018-06-22T07:33:29Z")
Where does Logstash send the data? Do you have persistent queues enabled in Logstash? ---
**Author:** ![JensVanDeynse](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Post date:** [June 22, 2018, 7:34am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/5 "2018-06-22T07:34:34Z")
To 2 elasticsearch nodes which also don't present any memory or CPU issues ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 22, 2018, 7:35am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/6 "2018-06-22T07:35:06Z")
What is the specification of those nodes? What indexing rates are they seeing? ---
**Author:** ![JensVanDeynse](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Post date:** [June 22, 2018, 7:38am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/7 "2018-06-22T07:38:51Z")
Both the servers have 4 cpu cores & 16 GB of memory They have a combined JVM heap of 20GB and an indexing rate of 1000 events/second at night and goes up to 3000-4000 events per second with a latency of 0.1 to 0.15 ms The maximum usage of JVM heap I've seen on the nodes is about 15GB so 75% I do see a fall in indexing rate during the issues but I assumed that the cause was because filebeat doesn't send data ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 22, 2018, 7:51am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/8 "2018-06-22T07:51:01Z")
Is there anything in the Elasticsearch logs indicating any problems? Are both nodes master-eligible? If so, have you set `minimum_master_nodes` to `2` to prevent split brain scenarios? ---
**Author:** ![JensVanDeynse](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Post date:** [June 22, 2018, 7:56am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/9 "2018-06-22T07:56:42Z")
The elasticsearch logs don't show any issues concerning that type of log That split brain issue on the other hand I still have to fix, nice catch ---
**Author:** ![JensVanDeynse](https://avatars.discourse-cdn.com/v4/letter/j/3d9bf3/32.png) [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Post date:** [June 25, 2018, 6:14am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/10 "2018-06-25T06:14:57Z")
Do you have any more information to fix this issue? This is happening every morning now and this doesn't seem to be an elasticsearch issue but more a filebeat issue ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 23, 2018, 6:14am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-single-log-file/136979/11 "2018-07-23T06:14:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.