# High CPU usage for logstash-agent

**URL:** <https://discuss.elastic.co/t/high-cpu-usage-for-logstash-agent/32325>\
**Category:** Logstash\
**Created:** [October 16, 2015, 3:00am UTC](https://discuss.elastic.co/t/high-cpu-usage-for-logstash-agent/32325 "2015-10-16T03:00:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![joiceedattel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joiceedattel/32/3811_2.png) [@joiceedattel](https://discuss.elastic.co/u/joiceedattel)\
**Post date:** [October 16, 2015, 3:00am UTC](https://discuss.elastic.co/t/high-cpu-usage-for-logstash-agent/32325/1 "2015-10-16T03:00:47Z")

</div>

The logstash-agent is consuming more than 100% of CPU in our nodes. Is there any solution to fix this issue .  
The logstash-agent.conf is as follows

* * *

input {  
file {  
type =\> "hybris\_console"  
add\_field =\> { "environment" =\> "PROD" }  
add\_field =\> { "application" =\> "hybris" }  
path =\> ["\<path\_of\_logfile\>-_"]  
codec =\> multiline {  
pattern =\> "(.+|.+|.+|.+|[]{3}._)|(.+|.+|.+|.+| ])|(.+|.+|.+|.+| SEVERE)|(.+|.+|.+|.+| de.hybris.platform)|(.+|.+|.+|.+| java.lang.NullPointerException)|(.+|.+|.+|.+|[]\t._)|(.+|.+|.+|.+|[]{9}._)"  
negate =\> false  
what =\> "previous"  
charset =\> "UTF-8"  
}  
}  
}  
output {  
stdout { }  
redis {  
host =\> ""  
data\_type =\> "list"  
key =\> "logstash"  
}  
}

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 16, 2015, 3:40am UTC](https://discuss.elastic.co/t/high-cpu-usage-for-logstash-agent/32325/2 "2015-10-16T03:40:10Z")

</div>

You're not running Logstash 1.4.x and having trouble with the Logstash _Web_ process, are you? Because it had a tendency to eat CPU once installed.

If it indeed is the agent that's consuming all that CPU, simplifying that regexp should help. It looks like you're trying to match continuation lines to make them meld with the previous line. I usually find it easier to craft an expression that matches non-continuation lines and set `negate => true`.

What kind of message rate are you seeing?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:26am UTC](https://discuss.elastic.co/t/high-cpu-usage-for-logstash-agent/32325/3 "2017-07-06T05:26:19Z")

</div>

Closed on July 6, 2017, 5:26am UTC