# Filebeat IIS module : high CPU consumption?

**URL:** https://discuss.elastic.co/t/filebeat-iis-module-high-cpu-consumption/161541
**Category:** Beats
**Created:** [December 19, 2018, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-high-cpu-consumption/161541 "2018-12-19T14:37:37Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Hellong](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@Hellong](https://discuss.elastic.co/u/Hellong)
#### Post date: [December 19, 2018, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-high-cpu-consumption/161541/1 "2018-12-19T14:37:37Z")

</div>

Hi,  
I use Filebeat with the IIS module to send logs to a distant Logstash, with the following configuration :

Filebeat.yml

```
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

# filebeat.inputs:
# other inputs

output.logstash:
  hosts: ["ltelsni3.cm-cic.fr:5045"]
  compression_level: 3

```

iis.yml

```
---
- module: iis
  # Access logs
  access:
    enabled: true
    var.paths: ["D:/appli/logfiles/IIS/**/*.log"]
    input:
      ignore_older: 168h
      clean_removed: true

  # Error logs
  error:
    enabled: true
    input:
      ignore_older: 168h
      clean_removed: true

```

My IIS log files are not archived, resulting in more than 20.000 files in the directory Filebeat is scanning. They all have a similar name (only the date in the name is changing), so I don't have any way to target the most recent ones with the Glob patterns.  
When started, Filebeat uses 20% CPU (which is a lot for us), with peaks at 35% CPU when the periodic modifiation date scan occurs.

I know the problem seems obvious : too much files at once. But is there anythin I could have missed (a parameter,...) that could help decreasing the CPU usage ?  
**Is there a parameter to prevent Filebeat from scanning the modification date of really old files ?**

Thanks in advance

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2019, 4:37pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-high-cpu-consumption/161541/2 "2019-01-16T16:37:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.