Filebeat.exe allocates too much memory on Windows server 2016

Dear Sir:

We use filebeat to parse our log and send the data to kafka -> logstash -> elasticsearch.
But we found the memory consumed by filebeat.exe was over 1.6Gb.

We also check the filebeat log.
{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":20094093,"time":{"ms":47}},"total":{"ticks":69999280,"time":{"ms":141},"value":69999280},"user":{"ticks":49905187,"time":{"ms":94}}},"handles":{"open":350},"info":{"ephemeral_id":"569cfdc9-b0fa-4fbc-8fe6-81beeca36c14","uptime":{"ms":25044600183}},"memstats":{"gc_next":44772592,"memory_alloc":22529120,"memory_total":239248376304}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}

The memory_alloc is about 21MB. But we got 1.7gb in our windows task manager.

  1. What is the correct monitoring data about the memory states? Windows task manager or filebeat log. Why we got different results between task manager and filebeat?
  2. The following is our env and filebeat.yml. Any suggestion about tuning the memory issue?

Filebeat version: 7.0.0
OS: Windows Server 2016



- type: log

  enabled: true

    - D:\Log\MsmqMonitorLogs\*
  multiline.pattern: '^\['

  multiline.negate: true
  multiline.match: after

  hosts: [""]
  topic: "test-topic"
    pretty: false

  - add_host_metadata: ~
  - add_cloud_metadata: ~

That's virtual memory, which is managed by the operating system.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.