# Filebeat Version 5.2 vs 5.0

**URL:** <https://discuss.elastic.co/t/filebeat-version-5-2-vs-5-0/75640>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 19, 2017, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-version-5-2-vs-5-0/75640 "2017-02-19T15:22:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ori.rubinfeld](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\
**Post date:** [February 19, 2017, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-version-5-2-vs-5-0/75640/1 "2017-02-19T15:22:01Z")

</div>

Hi,

I am on Dev, and very close to Prod.  
I have an ELK Env version 5.0 installed with Filebeat 5.0

The Filebeat is on a Central Windows Server with Shares to Defferent Application Servers Logs Folders.  
I have 22 Filebeat Services, each with 4 Prospector, each Prospector is for the same Log Type.  
There are 4 Different Application Servers.

When I am using on that Dedicated Windows Machine Filebeat 5.0, the CPU is at 60% +/-5%  
While using the Filebeat 5.2, the CPU is at 80% +-5%

Should there be any additional work that the Filebeat 5.2 is making and Filebeat 5.0 is not ?  
I know that there are clean\_\* parameters which are TRUE for 5.2, with differ from 5.0

I need to understand the cause for that High CPU, So I will be able to decide if should be using 5.2 or remain with 5.0  
There is a Bug solved in 5.2, which I have encountered with 5.0 - On Restart, The filebeat did not send any new events, until I have restart it again, and deleted the registry file.

Thanks,

Ori

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [February 21, 2017, 8:52am UTC](https://discuss.elastic.co/t/filebeat-version-5-2-vs-5-0/75640/2 "2017-02-21T08:52:27Z")

</div>

So far I'm not aware of any changes between Filebeat 5.0 and 5.2 that would explain such a difference. Also I would not expect to have the `clean_*` options to have any major affect except you would have a very large number of files and very fast rotation of files.

Did you try to run 5.0 and 5.2 on the same machine with the same log files, config and environment, and see if there is a difference?

---

<div class="post-metadata">

**Author:** ![ori.rubinfeld](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\
**Post date:** [February 21, 2017, 9:01am UTC](https://discuss.elastic.co/t/filebeat-version-5-2-vs-5-0/75640/3 "2017-02-21T09:01:31Z")

</div>

Yes, Exactly the same configuration.  
Only replacing the Filebeat Executable.

Ori

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [February 23, 2017, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-version-5-2-vs-5-0/75640/4 "2017-02-23T14:00:49Z")

</div>

Can you share the config you are using?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2017, 2:01pm UTC](https://discuss.elastic.co/t/filebeat-version-5-2-vs-5-0/75640/5 "2017-03-23T14:01:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.