# Find the Slowest Filebeat

**URL:** <https://discuss.elastic.co/t/find-the-slowest-filebeat/233405>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 19, 2020, 8:38pm UTC](https://discuss.elastic.co/t/find-the-slowest-filebeat/233405 "2020-05-19T20:38:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssarpotdar](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@ssarpotdar](https://discuss.elastic.co/u/ssarpotdar)\
**Post date:** [May 19, 2020, 8:38pm UTC](https://discuss.elastic.co/t/find-the-slowest-filebeat/233405/1 "2020-05-19T20:38:26Z")

</div>

Hello,  
I am new to ELK stack. I have several Filebeats configured to send the logs to Logstash and also enabled Filebeat to send the monitoring data to Elastic search. I have a downstream process that needs to process the events until the slowest sender's last published timestamp to avoid unnecessary errors. The downstream process needs to pause the processing if any of the Filebeats is down or is lagging behind.

For e.g. if there are 3 Filebeats and the last time stamps they successfully sent and got acknowledgement from Logstash are 2020-05-20 10:00:00.001, 2020-05-20 10:00:05.565 and 2020-05-20 10:00:05.575 respectively. Then I would like the downstream process to process the events only until 2020-05-20 10:00:00.001 and pause since that is the last published and acknowledged timestamp from slowest Filebeat (Filebeat1).

I was planning to write logic in the downstream process to query Elastic search and use the heartbeat data to find the slowest Filebeat.

1. Is there a way I could figure out the slowest Filebeat using the following fields for each file in the harvester from the monitoring heartbeat?

```auto
    last_event_published_time 
    last_event_timestamp
    read_offset 
    size

```

1. Does `last_event_published_time` mean the last time Filebeat published an event and got an acknowledgement from Logstash and does `last_event_timestamp` mean last time it read an event from log file?

Thanks in advance for all the help,  
Suvelee

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2020, 8:38pm UTC](https://discuss.elastic.co/t/find-the-slowest-filebeat/233405/2 "2020-06-16T20:38:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.