# High cpu load, just a one node working on 100%

**URL:** <https://discuss.elastic.co/t/high-cpu-load-just-a-one-node-working-on-100/300751>\
**Category:** Elasticsearch\
**Created:** [March 26, 2022, 12:04pm UTC](https://discuss.elastic.co/t/high-cpu-load-just-a-one-node-working-on-100/300751 "2022-03-26T12:04:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![phmean21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phmean21/32/103541_2.png) [@phmean21](https://discuss.elastic.co/u/phmean21)\
**Post date:** [March 26, 2022, 12:04pm UTC](https://discuss.elastic.co/t/high-cpu-load-just-a-one-node-working-on-100/300751/1 "2022-03-26T12:04:21Z")

</div>

Hi everyone, i`m newbie an elastic.  
I have cluster of 3 nodes with ES 7.15.0.  
Problem is just 1 node working on indexing.

```auto
curl -s -XGET -u user:pass "mv-elk-data-01:9200/_cat/thread_pool" |grep " write "
mv-elk-data-02 write 0 0 0
mv-elk-data-03 write 0 0 0
mv-elk-data-01 write 8 390 0

```

I use filebeat send logs to 2 logstash instances.

```auto
output.logstash:
  hosts: ["172.23.0.35:5044", "172.23.0.36:5044"]
  loadbalance: true

```

Logstash also have all my nodes in config.  
`xpack.monitoring.elasticsearch.hosts: ["http://172.23.0.37:9200", "http://172.23.0.38:9200", "http://172.23.0.39:9200"]`

Nodes runs in this mode:

```auto
discovery.seed_hosts: ["mv-elk-data-01", "mv-elk-data-02", "mv-elk-data-03"]
cluster.initial_master_nodes: ["mv-elk-data-01", "mv-elk-data-02", "mv-elk-data-03"]

```

Also my problem node(mv-elk-data-01) have the minimal count of shards, in all of 3 nodes. Maybe is the reason?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 28, 2022, 1:05am UTC](https://discuss.elastic.co/t/high-cpu-load-just-a-one-node-working-on-100/300751/2 "2022-03-28T01:05:24Z")

</div>

Welcome to our community! 😃

> [@phmean21](#):
>
> I use filebeat send logs to 2 logstash instances.

What does Logstash have configured to talk to Elasticsearch?

---

<div class="post-metadata">

**Author:** ![phmean21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phmean21/32/103541_2.png) [@phmean21](https://discuss.elastic.co/u/phmean21)\
**Post date:** [March 28, 2022, 7:37am UTC](https://discuss.elastic.co/t/high-cpu-load-just-a-one-node-working-on-100/300751/3 "2022-03-28T07:37:26Z")

</div>

> [@warkolm](#):
>
> What does Logstash have configured to talk to Elasticsearch?

Hi, thank you for replying.  
My Logstash config:

```auto
grep -ve "#" /etc/logstash/logstash.yml
path.data: /var/lib/logstash
pipeline.workers: 64
pipeline.batch.size: 1024
pipeline.batch.delay: 10
pipeline.ordered: auto
queue.type: memory
log.level: info
path.logs: /var/log/logstash
xpack.monitoring.enabled: false
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: logstash_system
xpack.monitoring.elasticsearch.hosts: ["http://172.23.0.37:9200", "http://172.23.0.38:9200", "http://172.23.0.39:9200"]

```

P.S.  
172.23.0.37-39 == mv-elk-data-01-03

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2022, 7:38am UTC](https://discuss.elastic.co/t/high-cpu-load-just-a-one-node-working-on-100/300751/4 "2022-04-25T07:38:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.