# Filebeat slower than logstash default "file" input?
**URL:** https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640
**Category:** Beats
**Tags:** filebeat
**Created:** [October 21, 2016, 4:30pm UTC](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640 "2016-10-21T16:30:07Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@remaselvi](https://discuss.elastic.co/u/remaselvi)
#### Post date: [October 21, 2016, 4:30pm UTC](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640/1 "2016-10-21T16:30:07Z")
Hi,
So far I have been using logstash's default "file" input plugin. I am giving filebeat a try with logstash.
Filebeat gives me a significant performance boost when it comes to reading large logfiles, this is great.
However, I noticed something else:
When appending a single log line manually to logstash through the filebeat input plugin and a simple stdout output without any additional processing in the middle, my payload is taking a lot longer to be processed (I'm talking \>5seconds delay complared to logstash input plugin).
My filebeat config is bare minimum. Is there anything I can do to improve this ?
thanks
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 21, 2016, 9:39pm UTC](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640/2 "2016-10-21T21:39:00Z")
maybe sharing your configuration files and more setup details (OS, filebeat/logsthas version, filesystem) might be a good start.
The 5 second delay sounds like you've enabled multiline support.
---
### Author:  [@remaselvi](https://discuss.elastic.co/u/remaselvi)
#### Post date: [October 22, 2016, 3:19am UTC](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640/3 "2016-10-22T03:19:37Z")
System:
- Linux Mint 18
- filebeat 1.3.1 (amd64)
- Logstash 2.4.0
- partition where logs are written is ext4 on a SSD drive
Config files:
$ cat filebeat.yml
```auto
filebeat:
prospectors:
-
paths:
- "/tmp/TEST.*.messages.log"
output:
logstash:
hosts: ["127.0.0.1:5044"]
```
$ cat logstash.conf
````auto
input {
beats {
port => 5044
}
}
output {
stdout { codec => rubydebug }
}
```
hope that helps
````
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [October 24, 2016, 7:43am UTC](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640/4 "2016-10-24T07:43:46Z")
If a file is not updated very frequently, filebeat backs off to not constantly poll the file. I assume before you added the line manually, the file wasn't updated for some time before. You can configure how much filebeat backs off with the config options here: [https://www.elastic.co/guide/en/beats/filebeat/5.0/configuration-filebeat-options.html#\_backoff](https://www.elastic.co/guide/en/beats/filebeat/5.0/configuration-filebeat-options.html#_backoff)
---
### Author:  [@remaselvi](https://discuss.elastic.co/u/remaselvi)
#### Post date: [October 24, 2016, 11:16am UTC](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640/5 "2016-10-24T11:16:46Z")
gotcha. good to know, thanks a lot !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 11, 2016, 4:30pm UTC](https://discuss.elastic.co/t/filebeat-slower-than-logstash-default-file-input/63640/6 "2016-11-11T16:30:06Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.