# Filebeat.exe allocates too much memory on Windows server 2016

**URL:** https://discuss.elastic.co/t/filebeat-exe-allocates-too-much-memory-on-windows-server-2016/249887
**Category:** Beats
**Tags:** filebeat
**Created:** [September 25, 2020, 1:37am UTC](https://discuss.elastic.co/t/filebeat-exe-allocates-too-much-memory-on-windows-server-2016/249887 "2020-09-25T01:37:50Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![petertw6235](https://avatars.discourse-cdn.com/v4/letter/p/3d9bf3/32.png) [@petertw6235](https://discuss.elastic.co/u/petertw6235)
#### Post date: [September 25, 2020, 1:37am UTC](https://discuss.elastic.co/t/filebeat-exe-allocates-too-much-memory-on-windows-server-2016/249887/1 "2020-09-25T01:37:50Z")

</div>

Dear Sir:

We use filebeat to parse our log and send the data to kafka -\> logstash -\> elasticsearch.  
But we found the memory consumed by filebeat.exe was over 1.6Gb.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/2/72a16bb627ccf5ef16666fec8bda3f14cd01cd1b.png)

We also check the filebeat log.  
`{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":20094093,"time":{"ms":47}},"total":{"ticks":69999280,"time":{"ms":141},"value":69999280},"user":{"ticks":49905187,"time":{"ms":94}}},"handles":{"open":350},"info":{"ephemeral_id":"569cfdc9-b0fa-4fbc-8fe6-81beeca36c14","uptime":{"ms":25044600183}},"memstats":{"gc_next":44772592,"memory_alloc":22529120,"memory_total":239248376304}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}`

The memory\_alloc is about 21MB. But we got 1.7gb in our windows task manager.  
`"memstats":{"gc_next":44772592,"memory_alloc":22529120,"memory_total":239248376304}}`

1. What is the correct monitoring data about the memory states? Windows task manager or filebeat log. Why we got different results between task manager and filebeat?
2. The following is our env and filebeat.yml. Any suggestion about tuning the memory issue?

Filebeat version: 7.0.0  
OS: Windows Server 2016

filebeat.yml

```
filebeat.inputs:

- type: log

  enabled: true

  paths:
    - D:\Log\MsmqMonitorLogs\*
  multiline.pattern: '^\['

  multiline.negate: true
  multiline.match: after

output.kafka:
  hosts: ["xxx.xxx.xxx.xxx:9092"]
  topic: "test-topic"
  codec.json:
    pretty: false

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
```

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 28, 2020, 3:46am UTC](https://discuss.elastic.co/t/filebeat-exe-allocates-too-much-memory-on-windows-server-2016/249887/2 "2020-09-28T03:46:57Z")

</div>

That's virtual memory, which is managed by the operating system.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 26, 2020, 5:47am UTC](https://discuss.elastic.co/t/filebeat-exe-allocates-too-much-memory-on-windows-server-2016/249887/3 "2020-10-26T05:47:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.