# High CPU Utilized by JAVA in single node ELK #31089 **URL:** \ **Category:** Elasticsearch\ **Created:** [June 5, 2018, 8:30am UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563 "2018-06-05T08:30:39Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Prabhu2430](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhu2430/32/41706_2.png) [@Prabhu2430](https://discuss.elastic.co/u/Prabhu2430)\ **Post date:** [June 5, 2018, 8:30am UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/1 "2018-06-05T08:30:39Z")
We are experiencing high CPU utilization when starting the elasticsearch & logstash services simultaneously. The JAVA process is occupying more than 300% CPU. The elasticsearch holds some multiple JAVA threads and makes the CPU reaches to max utilization. Elasticsearch version (bin/elasticsearch --version): 2.3.4 JVM version (java -version): 1.8.0 OS version (uname -a if on a Unix-like system): RHEL 7.2 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc843e34bfb8a0a9a90f30824c869bb7f08b6643.png) ---
**Author:** ![Prabhu2430](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhu2430/32/41706_2.png) [@Prabhu2430](https://discuss.elastic.co/u/Prabhu2430)\ **Post date:** [June 14, 2018, 5:36am UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/2 "2018-06-14T05:36:30Z")
Team, Can you help on this? We are at critical state due to this CPU issue. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 14, 2018, 5:49am UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/3 "2018-06-14T05:49:03Z")
Do you have monitoring installed? How much indexing and querying is the node handling when the CPU usage goes up? ---
**Author:** ![Prabhu2430](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhu2430/32/41706_2.png) [@Prabhu2430](https://discuss.elastic.co/u/Prabhu2430)\ **Post date:** [June 14, 2018, 5:59am UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/4 "2018-06-14T05:59:50Z")
Hi, We have nagios installed for monitoring the load . the load keeps on fluctuating and its has lot of threads running at the backend. When I query the indices , I am getting the below o/p with lot of indices in open state. ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/3/532f09be19b2e70dfec016dc7bff9d072a357a30.png) Please assist, since I am very new to ELK ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 14, 2018, 6:05am UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/5 "2018-06-14T06:05:45Z")
You seem to have a lot of small shards, so please read [this blog post](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster) for some guidance on shards and sharding practices. When you look at monitoring and amount of data indexed, do you see any correlation between indexed volume and CPU usage? ---
**Author:** ![Prabhu2430](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhu2430/32/41706_2.png) [@Prabhu2430](https://discuss.elastic.co/u/Prabhu2430)\ **Post date:** [June 14, 2018, 9:26am UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/6 "2018-06-14T09:26:11Z")
Yes Christian. Initial days the CPU usage was very well under control. Now, as the data indices are growing it starts affecting my CPU usage. Also, I could suspect that my indices are creating duplicates as the older date indices are also growing on day to day basis as well. Please advise on how to avoid duplicate indices from getting created . ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 14, 2018, 9:37am UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/7 "2018-06-14T09:37:00Z")
Have a look at your ingest pipeline and make sure it is configured correctly so it does not resend old data. ---
**Author:** ![Ravichandran](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Ravichandran](https://discuss.elastic.co/u/Ravichandran)\ **Post date:** [June 20, 2018, 12:19pm UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/8 "2018-06-20T12:19:20Z")
Could you please be more specific on which configuration file to be checked? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 20, 2018, 12:32pm UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/9 "2018-06-20T12:32:00Z")
I do not know anything about how you are ingesting data, so it is hard to be more specific. How are you ingesting data into Elasticsearch? ---
**Author:** ![Ravichandran](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Ravichandran](https://discuss.elastic.co/u/Ravichandran)\ **Post date:** [June 20, 2018, 2:34pm UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/10 "2018-06-20T14:34:08Z")
- Using RabbitMQ as buffer - Configured Logstash to push logs to RabbitMQ - Pulling logs from RabbitMQ and indexing Is any other information required? ---
**Author:** ![Ravichandran](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@Ravichandran](https://discuss.elastic.co/u/Ravichandran)\ **Post date:** [June 21, 2018, 12:14pm UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/11 "2018-06-21T12:14:11Z")
@Christian_Dahlqvist Please find below the logstash.conf ``` input { rabbitmq { host => "10.x.x.x" port => 5670 ssl_certificate_password => 'xxxxx' ssl_certificate_path => Vetc/logstash/ssl_cert/client/keycert.p12' ssl_version => "TLSv1.2" ssl => true durable => false exchange => "elasticsearch-exchange" queue => "indexer-queue" vhost => "es_vhost" key => "logstash-routing_key" user => "xxxx" password => "xxxx" heartbeat => "15" automatic_recovery => false connect_retry_interval => 1 exchange type => "direct" } } output { elasticsearch { hosts => ["localhostm] index => "immediate-%(+YYYY.MM.dd}" } } input { file { path => "/var/log/messages" start position => "end" } } filter { grok { match => "message" => "%{SYSLOGTIMESTAMP:system_auth_timestamp} %{SYSLOGHOST:system_auth_hostname} %{GREEDYDATA:command_issued}: %{GREEDYDATA:message}" } add tag => "syslog" } } output { rabbitmq { exchange => "elasticsearch-exchange" exchange_type => "direct" key => "logstash-routing_key" ssl => true durable => false ssl_certificate_password => 'xxxxx' ssl_certificate_path => 'etc/logstash/ssl_cert/client/keycert.p12' ssl_version => "TLSv1.2" host => "10.x.x.x" vhost => "es_vhost" persistent => true passive => true port => "5671" user => "xxxx" password => "xxxx" } } ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 21, 2018, 2:36pm UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/12 "2018-06-21T14:36:59Z")
I do unfortunately not have much experience with RabbitMQ, so may not be able to help much. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 19, 2018, 2:37pm UTC](https://discuss.elastic.co/t/high-cpu-utilized-by-java-in-single-node-elk-31089/134563/13 "2018-07-19T14:37:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.