# Filebeat in elastic agent is consuming more RAM in windows

**URL:** <https://discuss.elastic.co/t/filebeat-in-elastic-agent-is-consuming-more-ram-in-windows/370057>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [November 5, 2024, 8:33am UTC](https://discuss.elastic.co/t/filebeat-in-elastic-agent-is-consuming-more-ram-in-windows/370057 "2024-11-05T08:33:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![suhasbhatt101](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@suhasbhatt101](https://discuss.elastic.co/u/suhasbhatt101)\
**Post date:** [November 5, 2024, 8:33am UTC](https://discuss.elastic.co/t/filebeat-in-elastic-agent-is-consuming-more-ram-in-windows/370057/1 "2024-11-05T08:33:11Z")

</div>

I am using elastic agent to collect custom logs from my windows server. Filebeat stream is consuming more than 1GB of RAM, some time it is consuming 3 to 4 GB RAM.  
When i remove the filebeat configurations from the elastic-agent.yml file and collect only the system metrics, the RAM consumption is only 200 MB.

Configuration used to collect custom log data:

```auto
  - type: filestream
    id: filestream-data
    streams:
      - id: powershell-logs
        enabled: true
        paths:
          - C:\Transcripts\*\*.txt
        data_stream:
          type: logs         
          dataset: filebeat
          namespace: powershell       

        parsers:
        - multiline:
            type: pattern
            pattern: '^Command start time:'
            negate: true
            match: after  
        fields:
          log_type: powershell-logs 

```

Can any one help why this is taking more RAM

Elastic agent version : 8.14  
Elasticsearch version: 8.14  
OS: Windows

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8379515a7f4aa2ce19d43257b33dea76de96ca9.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 5, 2024, 12:26pm UTC](https://discuss.elastic.co/t/filebeat-in-elastic-agent-is-consuming-more-ram-in-windows/370057/2 "2024-11-05T12:26:05Z")

</div>

> [@suhasbhatt101](#):
>
> Can any one help why this is taking more RAM

Your input is reading text files and using the multiline parser, depending on the size of those files this would be expected.

It needs to keep the lines in memory until a new match is found, so this will use memory, how much will probably depend on the number of files and the size of them.

---

<div class="post-metadata">

**Author:** ![suhasbhatt101](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@suhasbhatt101](https://discuss.elastic.co/u/suhasbhatt101)\
**Post date:** [November 8, 2024, 9:10am UTC](https://discuss.elastic.co/t/filebeat-in-elastic-agent-is-consuming-more-ram-in-windows/370057/3 "2024-11-08T09:10:22Z")

</div>

This folder has 2 to 3 years of logs, How can i make it to send only the new logs and not to send old logs.