Filebeat IIS module : high CPU consumption?

Elastic Stack Beats
1

Hi,
I use Filebeat with the IIS module to send logs to a distant Logstash, with the following configuration :

Filebeat.yml

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

# filebeat.inputs:
# other inputs

output.logstash:
  hosts: ["ltelsni3.cm-cic.fr:5045"]
  compression_level: 3

iis.yml

---
- module: iis
  # Access logs
  access:
    enabled: true
    var.paths: ["D:/appli/logfiles/IIS/**/*.log"]
    input:
      ignore_older: 168h
      clean_removed: true


  # Error logs
  error:
    enabled: true
    input:
      ignore_older: 168h
      clean_removed: true

My IIS log files are not archived, resulting in more than 20.000 files in the directory Filebeat is scanning. They all have a similar name (only the date in the name is changing), so I don't have any way to target the most recent ones with the Glob patterns.
When started, Filebeat uses 20% CPU (which is a lot for us), with peaks at 35% CPU when the periodic modifiation date scan occurs.

I know the problem seems obvious : too much files at once. But is there anythin I could have missed (a parameter,...) that could help decreasing the CPU usage ?
Is there a parameter to prevent Filebeat from scanning the modification date of really old files ?

Thanks in advance

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.