Filebeat Version 5.2 vs 5.0

Elastic Stack Beats
1

Hi,

I am on Dev, and very close to Prod.
I have an ELK Env version 5.0 installed with Filebeat 5.0

The Filebeat is on a Central Windows Server with Shares to Defferent Application Servers Logs Folders.
I have 22 Filebeat Services, each with 4 Prospector, each Prospector is for the same Log Type.
There are 4 Different Application Servers.

When I am using on that Dedicated Windows Machine Filebeat 5.0, the CPU is at 60% +/-5%
While using the Filebeat 5.2, the CPU is at 80% +-5%

Should there be any additional work that the Filebeat 5.2 is making and Filebeat 5.0 is not ?
I know that there are clean_* parameters which are TRUE for 5.2, with differ from 5.0

I need to understand the cause for that High CPU, So I will be able to decide if should be using 5.2 or remain with 5.0
There is a Bug solved in 5.2, which I have encountered with 5.0 - On Restart, The filebeat did not send any new events, until I have restart it again, and deleted the registry file.

Thanks,

Ori

2

So far I'm not aware of any changes between Filebeat 5.0 and 5.2 that would explain such a difference. Also I would not expect to have the clean_* options to have any major affect except you would have a very large number of files and very fast rotation of files.

Did you try to run 5.0 and 5.2 on the same machine with the same log files, config and environment, and see if there is a difference?

3

Yes, Exactly the same configuration.
Only replacing the Filebeat Executable.

Ori

4

Can you share the config you are using?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.