# Filebeat processors
**URL:** https://discuss.elastic.co/t/filebeat-processors/328275
**Category:** Beats
**Tags:** filebeat
**Created:** [March 22, 2023, 4:52pm UTC](https://discuss.elastic.co/t/filebeat-processors/328275 "2023-03-22T16:52:57Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)
#### Post date: [March 22, 2023, 4:52pm UTC](https://discuss.elastic.co/t/filebeat-processors/328275/1 "2023-03-22T16:52:57Z")
Hi everyone,
I have a question about the filebeat processors (extract\_array, drop\_event, drop\_fields).
My filebeat agent collects about 2500 logs lines a second. Do you think that using these processors can lead to huge CPU usage ? And if it's possible, what about delegate these operations to logstash ?
Thanks for your answer.
Khaled
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 22, 2023, 5:04pm UTC](https://discuss.elastic.co/t/filebeat-processors/328275/2 "2023-03-22T17:04:17Z")
Are you already sending the data to Logstash? If yes, then I would leave any data transformation to be done in Logstash.
If not, you will need to try, but I don't think that these processor will impact the CPU usage in any way.
---
### Author:  [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)
#### Post date: [March 23, 2023, 7:34am UTC](https://discuss.elastic.co/t/filebeat-processors/328275/3 "2023-03-23T07:34:13Z")
Hi Leandro,
I agree with you to do data tranformation in logstash. My filebeat process sends logs to a kafka server and then logstash consume the kafka messages. I'm facing a huge CPU usage when filebeat collects logs. So i'm gonna try to move filebeat data transformation in logstash and i will see if this decrease the CPU usage.
Thx for your help.
Khaled
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 20, 2023, 9:34am UTC](https://discuss.elastic.co/t/filebeat-processors/328275/4 "2023-04-20T09:34:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.