# Harvester\_buffer\_size - why increase it?

**URL:** https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226
**Category:** Beats
**Tags:** filebeat
**Created:** [March 9, 2022, 1:46pm UTC](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226 "2022-03-09T13:46:07Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![mikewillis](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@mikewillis](https://discuss.elastic.co/u/mikewillis)
#### Post date: [March 9, 2022, 1:46pm UTC](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226/1 "2022-03-09T13:46:07Z")

</div>

The documentation says what the `harvest_buffer_size` setting of the `log` input is for, but I don't see anything about why one might want to change it.

> **[Log input | Filebeat Reference \[7.17\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-input-log.html#_harvester_buffer_size_3)**

I noticed that a Filebeat 7.17 instance on a CentOS 7 server that is sending a lot of data from multiple files to the Logstash layer our of logging system was using 10s of GB of memory and causing a problem with memory exhaustion. `harvester_buffer_size` had been set to `1048576000` but I don't know why. Commenting out that bit of the config has greatly reduced the memory usage and casual observation shows data still reaching our cluster at the same rate. Other than because you would want Filebeat to use more memory, why would one increase `harvester_buffer_size` above the default?

---

<div class="post-metadata">

### Author: ![Andrea\_Spacca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_spacca/32/76976_2.png) [@Andrea\_Spacca](https://discuss.elastic.co/u/Andrea_Spacca)
#### Post date: [March 10, 2022, 9:58am UTC](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226/2 "2022-03-10T09:58:29Z")

</div>

hi @mikewillis

tweaking `harvester_buffer_size` value has impact on the performance. When optimisation is a concern it is possible to set the most efficient value that can vary according to the environment.

---

<div class="post-metadata">

### Author: ![mikewillis](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@mikewillis](https://discuss.elastic.co/u/mikewillis)
#### Post date: [March 14, 2022, 10:04am UTC](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226/3 "2022-03-14T10:04:49Z")

</div>

OK, so I guess increasing the value is supposed to increase the performance. Is that right? How would one know what the most efficient value might be?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 11, 2022, 12:05pm UTC](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226/4 "2022-04-11T12:05:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
