Filebeat IIS module : high CPU consumption?

I use Filebeat with the IIS module to send logs to a distant Logstash, with the following configuration :


  path: ${path.config}/modules.d/*.yml

# filebeat.inputs:
# other inputs

  hosts: [""]
  compression_level: 3


- module: iis
  # Access logs
    enabled: true
    var.paths: ["D:/appli/logfiles/IIS/**/*.log"]
      ignore_older: 168h
      clean_removed: true

  # Error logs
    enabled: true
      ignore_older: 168h
      clean_removed: true

My IIS log files are not archived, resulting in more than 20.000 files in the directory Filebeat is scanning. They all have a similar name (only the date in the name is changing), so I don't have any way to target the most recent ones with the Glob patterns.
When started, Filebeat uses 20% CPU (which is a lot for us), with peaks at 35% CPU when the periodic modifiation date scan occurs.

I know the problem seems obvious : too much files at once. But is there anythin I could have missed (a parameter,...) that could help decreasing the CPU usage ?
Is there a parameter to prevent Filebeat from scanning the modification date of really old files ?

Thanks in advance

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.