Fresh install - high CPU load

[dmnc]

Hi, I'm completely new in Elastic Search. I've installed E+L+K (logstash 6.0.1) on the officially supported Debian 9.3 following the official documentation. After installation I let it be and did nothing with it, today I found that logstash is eating my CPU. I've upgraded (by apt-get upgrade) to the 6.1.1 with no difference. It is running on headless JRE from OpenJDK which is AFAIK officially supported.

Please do I need to install full JDK for some jstack tools (just googled about it) or how to find the problem?

Again, there is no custom configuration, no beats, this is brand new installation so there is something wrong with java or logstash itself. FML

ps output:

logstash 32348  188  4.0 3445580 331980 ?      SNsl 15:51   0:18 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash

[guyboertje]

Is the Logstash PID changing very often?

If so, then LS is stopping and the OS service manager (systemd) is restarting it. When starting there is much work to do - compiling the config, JRuby JIT compilation etc, therefore high CPU.

Logstash will exit if it does not find a config to compile or if the config or any settings have a syntax error.
If this happens the service manager tries to restart it.

If this is the case then the error is not logged to the LS logs but to the service console and into the journald subsystem AFAICT.

Try using journalctl to access the services logs. Try looking at dmesg output too.

Post what you find.

[dmnc]

I see, it make sense. And as friend of mine wrote me too, when logstash has no work (no config, etc.) it shutdowns by itself. Thank you, problem solved.