# Filebeat performance, 430 containers

**URL:** <https://discuss.elastic.co/t/filebeat-performance-430-containers/390622>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 24, 2026, 5:18am UTC](https://discuss.elastic.co/t/filebeat-performance-430-containers/390622 "2026-09-24T05:18:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![zerkms](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerkms/32/148273_2.png) [@zerkms](https://discuss.elastic.co/u/zerkms)\
**Post date:** [September 24, 2026, 5:18am UTC](https://discuss.elastic.co/t/filebeat-performance-430-containers/390622/1 "2026-09-24T05:18:13Z")

</div>

I'm migrating from quite an old ES+fluentbit configuration (logging solution for a small kubernetes cluster).

And this is quite simple yet inefficient (?) config I came up with (this file is generated by ECK using the `Beat` CRD):

```yaml
# cat /etc/beat.yml
filebeat:
    autodiscover:
        providers:
            - add_resource_metadata:
                cronjob: true
                deployment: true
              hints:
                default_config:
                    file_identity:
                        fingerprint: null
                    id: kubernetes-container-logs-${data.kubernetes.pod.name}-${data.kubernetes.container.id}
                    parsers:
                        - container: null
                    paths:
                        - /var/log/containers/*${data.kubernetes.container.id}.log
                    prospector:
                        scanner:
                            fingerprint:
                                enabled: true
                            symlinks: true
                    type: filestream
                enabled: true
              node: ${NODE_NAME}
              type: kubernetes
    inputs:
        - fields:
            log_source: dmesg
          fields_under_root: true
          id: dmesg
          include_matches:
            match:
                - _TRANSPORT=kernel
          paths:
            - /var/log/journal
          seek: since
          since: -24h
          type: journald
        - fields:
            log_source: journald
          fields_under_root: true
          id: systemd-services
          paths:
            - /var/log/journal
          seek: since
          since: -24h
          type: journald
          units:
            - containerd.service
            - kubelet.service
output:
    elasticsearch:
        hosts:
            - http://elasticsearch-es-http.<redacted>.svc:9200
        password: <redacted>
        ssl:
            certificate_authorities:
                - /mnt/elastic-internal/elasticsearch-certs/ca.crt
        username: <redacted>-container-logs-beat-user

```

On a node with ~200 pods (and ~430 containers) the `filebeat` process consumes around 0.7-0.8 CPU constantly. While `fluentbit` is at ~0.01 on the same machine.

Question: is `filebeat` really so inefficient per-se, or I have made some obviously terrible mistake configuring it?