# How to check and fix Logstash performance

**URL:** https://discuss.elastic.co/t/how-to-check-and-fix-logstash-performance/53495
**Category:** Logstash
**Created:** [June 21, 2016, 12:24pm UTC](https://discuss.elastic.co/t/how-to-check-and-fix-logstash-performance/53495 "2016-06-21T12:24:46Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![ori.rubinfeld](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)
#### Post date: [June 21, 2016, 12:24pm UTC](https://discuss.elastic.co/t/how-to-check-and-fix-logstash-performance/53495/1 "2016-06-21T12:24:46Z")

</div>

Hi All,

I am having several servers (windows) running filebeat to get log files and send events to the Logstash.  
Logstash and Elasticsearch runs on the same Linux machine.

I have developed a monitor scheduled script on the windows servers, which every 5 minutes writes a line into a monitored file which filebeat reads it and sends data to the Logstash. The Logstash takes the data and insert into a specific index.

sometimes that heartbeat data is being analyzed by Logstash, after 2 or 3 minutes it was written to the monitored log file, which can be caused by an overloaded Logstash process.

Questions:

1. How can I monitor the Performance of the Logstash and Indexing in Elasticsearch ?
2. what are best practices for cases when number of Input plugins is huge.  
5 Servers of type I  
16 Servers of type II  
10 Servers of type III  
3 Servers of type IV

(\*) Servers of type I, has many prospectors (15) in the Filebeat config.  
Would like to have best practices for such a config.

Thanks,

Ori

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 4, 2016, 6:54pm UTC](https://discuss.elastic.co/t/how-to-check-and-fix-logstash-performance/53495/2 "2016-07-04T18:54:22Z")

</div>

> 1. How can I monitor the Performance of the Logstash and Indexing in Elasticsearch ?

Use e.g. Marvel to monitor ES. For Logstash you can perhaps use the metrics plugin and a time-series database like Graphite. Logstash's new metrics APIs could also be of help.

> 1. what are best practices for cases when number of Input plugins is huge.

Define "huge".

---

<div class="post-metadata">

### Author: ![wenpos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wenpos/32/15326_2.png) [@wenpos](https://discuss.elastic.co/u/wenpos)
#### Post date: [January 18, 2017, 12:41am UTC](https://discuss.elastic.co/t/how-to-check-and-fix-logstash-performance/53495/3 "2017-01-18T00:41:40Z")

</div>

@magnusbaecki Hi could you please explain how the filter plugin 'metrics' indicate the output rate (msg/sec). I have seen the doc that describes '"[thing][rate\_1m]" - the per-second event rate in a 1-minute sliding window' , when I get the 1m\_rate with rate: 3458.8, does it mean the output performance is 3458.8 msg/second ? or it is just 3458.8 msg/min? Thank you very match

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 18, 2017, 6:30am UTC](https://discuss.elastic.co/t/how-to-check-and-fix-logstash-performance/53495/4 "2017-01-18T06:30:54Z")

</div>

> does it mean the output performance is 3458.8 msg/second ?

Yes, the average rate per second over the last minute.

---

<div class="post-metadata">

### Author: ![wenpos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wenpos/32/15326_2.png) [@wenpos](https://discuss.elastic.co/u/wenpos)
#### Post date: [January 18, 2017, 6:31am UTC](https://discuss.elastic.co/t/how-to-check-and-fix-logstash-performance/53495/5 "2017-01-18T06:31:34Z")

</div>

thank you very much！

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/how-to-check-and-fix-logstash-performance/53495/6 "2017-07-06T04:29:18Z")

</div>


