# Filebeat - High CPU for windows machines **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 25, 2016, 10:49am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920 "2016-08-25T10:49:15Z")\ **Posts on this page:** 7\ **Page:** 2
**Author:** ![ori.rubinfeld](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Post date:** [September 12, 2016, 11:14am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920/21 "2016-09-12T11:14:51Z")
I am removing it before start. If I am not removing it, so it does not start to run on the log file, since it has already read it. I did not really checked the content of it, just delete it each time before each run. Ori ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [September 12, 2016, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920/22 "2016-09-12T15:18:16Z")
Can you check if you still find this error messages in your logs, and if yes check the content of the file to see if the content is up-to-date? Also interesting to know how often you see the message. ---
**Author:** ![ori.rubinfeld](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Post date:** [September 13, 2016, 1:03pm UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920/23 "2016-09-13T13:03:56Z")
Will try to. Ori ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [September 14, 2016, 7:19am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920/24 "2016-09-14T07:19:10Z")
Just saw your comment in: [Filebeat 5.0 with multiline, split event data to two events](https://discuss.elastic.co/t/filebeat-5-0-with-multiline-split-event-data-to-two-events/60380/5) Does that mean you see less CPU usage under Linux, means this could be a Windows specific issue? ---
**Author:** ![ori.rubinfeld](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Post date:** [September 14, 2016, 9:51am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920/25 "2016-09-14T09:51:20Z")
Hi Ruflin, I did saw less CPU usage under linux, but it was running against a Dev Server, which has much much less activity than on Prod Servers. Since I am making changes to use the ingest node directly and not go through Logstash, currently for 22 different log types, I am having a dedicated filebeat process to read the logs. So it is not entirely the same configuration...... It is hard to tell...... Ori ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [September 15, 2016, 6:08am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920/26 "2016-09-15T06:08:20Z")
In case you see some differences in the future, that would be interesting to hear. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 15, 2016, 10:49am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920/27 "2016-09-15T10:49:32Z")
This topic was automatically closed after 21 days. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/filebeat-high-cpu-for-windows-machines/58920.md?page=1)