# Filebeat Performance

**URL:** <https://discuss.elastic.co/t/filebeat-performance/101946>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 27, 2017, 7:59am UTC](https://discuss.elastic.co/t/filebeat-performance/101946 "2017-09-27T07:59:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ori.rubinfeld](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\
**Post date:** [September 27, 2017, 7:59am UTC](https://discuss.elastic.co/t/filebeat-performance/101946/1 "2017-09-27T07:59:18Z")

</div>

Hi,

My filebeat config file has 5 prospectors.  
Each one access a network path on one of five application servers.

app\_server\_01, d:\app\_server\logs\app\_server\_01.log  
app\_server\_02, d:\app\_server\logs\app\_server\_02.log  
app\_server\_03, d:\app\_server\logs\app\_server\_03.log  
app\_server\_04, d:\app\_server\logs\app\_server\_04.log  
app\_server\_05, d:\app\_server\logs\app\_server\_05.log

Logs are being rotated.

The Filebeat sends the data to ingest node in Elastic.

While accessing the data using Kibana.  
It seems that data is being received in Realtime from app\_server\_01, but from app\_server\_03, there is a long delay, like for 30 minutes and data has not been received yet.

After a while, the data does get indexed in Elastic Search.

I need to have it all in as close as it can be to Real Time.

What can be checked for the Configuration ?  
What can cause such a delay on one machine, and no delay on the other (Using same FB, different prospectors accessing the files) ?

Thanks,

Ori

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 27, 2017, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-performance/101946/2 "2017-09-27T13:08:50Z")

</div>

Please share your Filebeat config, version, and OS.

If you are reading the files over a network share I would think this is most likely the cause. See [Can’t read log files from network volumes?](https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes).

---

<div class="post-metadata">

**Author:** ![ori.rubinfeld](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\
**Post date:** [September 28, 2017, 7:33am UTC](https://discuss.elastic.co/t/filebeat-performance/101946/3 "2017-09-28T07:33:32Z")

</div>

Hi,

Apparently it is a Log4J issue on windows machines.  
The Modification data is not being updated while the file is being populated, but randomly.

This is a very serious issue, as we can not provide a Real Time indexing of the logs data.

Ori

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 26, 2017, 7:33am UTC](https://discuss.elastic.co/t/filebeat-performance/101946/4 "2017-10-26T07:33:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.