Noticed on some servers (Windows Server 2012R2) that filebeat.exe process can use up to 1.5GB of RAM. Service restart solves the problem but I would like to know the reason and ways to troubleshoot. Many thanks.
What kind of memory usage are we talking about? Virtual memory? Working set size? Private bytes? E.g. Process Explorer can give you this information (maybe also newer versions of Task Manager).
See the screenshot with current situation. It is growing up after service restart.
Okay, but this isn't necessarily a problem since it's the virtual size. The virtual size grows e.g. when a file is mapped into memory, regardless of whether it ever touches RAM. The peak working set is just 48 MB so it has never used more RAM than that. I'd expect the Filebeat team to know more about why it might look like this.
1 Like
High virtual size is typical of 64-bit Go programs.
1 Like
Is it expected? Here is another example. After 1 week filebeat.exe has been grown up. It uses more than 400MB now. Usually it uses less than 10MB.
~400MB seems high. What version of Filebeat are you running? What does your config look like? Is there anything interesting in the log file?
Filebeat supports generation of a memory profile using -memprofile . Can you run filebeat with this setting and share the generated profile with us?
I am experiencing a similar issue with filebeat-1.2.3 on centos7.
The log file that is being tracked reaches a maximum size of about 9.6MB and rotates out every couple days.
At startup, filebeat will start using 200-300MB of memory and over the course of 10-15 minutes will ramp up to as much as 900MB.
Attached you'll find my filebeat.yml as well as a memprofile from about a 10 minute period of the filebeat process running.
@flodense Can you open a new topic, please? The original thread was on Windows. Please also post the top line, or similar, for Filebeat.
@tudor Done. For reference https://discuss.elastic.co/t/filebeat-memory-usage-linux/63772/1
This topic was automatically closed after 21 days. New replies are no longer allowed.