I am on Dev, and very close to Prod.
I have an ELK Env version 5.0 installed with Filebeat 5.0
The Filebeat is on a Central Windows Server with Shares to Defferent Application Servers Logs Folders.
I have 22 Filebeat Services, each with 4 Prospector, each Prospector is for the same Log Type.
There are 4 Different Application Servers.
When I am using on that Dedicated Windows Machine Filebeat 5.0, the CPU is at 60% +/-5%
While using the Filebeat 5.2, the CPU is at 80% +-5%
Should there be any additional work that the Filebeat 5.2 is making and Filebeat 5.0 is not ?
I know that there are clean_* parameters which are TRUE for 5.2, with differ from 5.0
I need to understand the cause for that High CPU, So I will be able to decide if should be using 5.2 or remain with 5.0
There is a Bug solved in 5.2, which I have encountered with 5.0 - On Restart, The filebeat did not send any new events, until I have restart it again, and deleted the registry file.