# How to improve Logstash performance imrpovement **URL:** \ **Category:** Logstash\ **Created:** [March 28, 2017, 11:46am UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289 "2017-03-28T11:46:01Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![udaykirankona](https://avatars.discourse-cdn.com/v4/letter/u/ac91a4/32.png) [@udaykirankona](https://discuss.elastic.co/u/udaykirankona)\ **Post date:** [March 28, 2017, 11:46am UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/1 "2017-03-28T11:46:01Z")
I have 5 node cluster as follows 4 nodes with each 16 GB RAM 4 Cores - ES 1 node with 32 GB RAM 8 cores - Logstash I am able to process 550000 records per one minute, I want improve it to more. So what changes I can do, I did following changes in **/etc/default/logstash** # Arguments to pass to logstash agent **LS\_OPTS="-b 1000 -w 16"** # Arguments to pass to java **LS\_HEAP\_SIZE="28g"** #LS\_JAVA\_OPTS="-Djava.io.tmpdir=$HOME" **LS\_JAVA\_OPTS="-Xmx30g -Xms2G"** also in **bin/logstash** # LS\_HEAP\_SIZE="xxx" size for the -Xmx${LS\_HEAP\_SIZE} maximum Java heap size option, default is "1g" **LS\_HEAP\_SIZE="28g"** # LS\_JAVA\_OPTS="xxx" to append extra options to the defaults JAVA\_OPTS provided by logstash **LS\_JAVA\_OPTS="-Xmx30g -Xms2g"** but still i don't see any improvement in logstash performance. Could you please provide some tips to improve Logstash performance. Thanks, Uday.K ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 28, 2017, 1:07pm UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/2 "2017-03-28T13:07:21Z")
What's the current bottleneck? CPU? Elasticsearch ingest rate? ---
**Author:** ![udaykirankona](https://avatars.discourse-cdn.com/v4/letter/u/ac91a4/32.png) [@udaykirankona](https://discuss.elastic.co/u/udaykirankona)\ **Post date:** [March 28, 2017, 1:41pm UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/3 "2017-03-28T13:41:22Z")
Hi Magnus, Thanks for your reply. the bottleneck is ingest rate. Thanks, Uday.K ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 28, 2017, 2:17pm UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/4 "2017-03-28T14:17:24Z")
If Elasticsearch is the bottleneck then I don't see how tweaking Logstash will help. ---
**Author:** ![udaykirankona](https://avatars.discourse-cdn.com/v4/letter/u/ac91a4/32.png) [@udaykirankona](https://discuss.elastic.co/u/udaykirankona)\ **Post date:** [March 28, 2017, 2:32pm UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/5 "2017-03-28T14:32:32Z")
sorry I mean logstash ingestion, 8 cores of cpu is using more than 80% each. even I increase heapsize no change in cpu usage. I already posted my config details.. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 28, 2017, 2:37pm UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/6 "2017-03-28T14:37:49Z")
What event rate can you reach if you replace the elasticsearch output with e.g. a file output? What event rate can you reach if you disable all filters? What if you do both? ---
**Author:** ![udaykirankona](https://avatars.discourse-cdn.com/v4/letter/u/ac91a4/32.png) [@udaykirankona](https://discuss.elastic.co/u/udaykirankona)\ **Post date:** [April 5, 2017, 12:46pm UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/7 "2017-04-05T12:46:29Z")
Hi Magnus, Sorry for late reply, 1. If I use file output with filter, not much change. rate is 570 K. 2. If I remove filter and use file output. rate is around 585 K. 3. If I remove multiline codec in input and remove filter and use ES output. rate is around 968 K. From above I see that slow rate is because of multiline codec in Logsatsh input. Is there any way to improve performance for input with multiline codec. Please suggest if any other changes I can do in my config. Thanks, Uday.K ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [April 5, 2017, 2:02pm UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/8 "2017-04-05T14:02:44Z")
The multiline codec is doing its job. Say you have a 1000 lines per second input then you have 1000 events per second. If the number of lines that belong to multiline is 50% then you will have 500 events per second. The same work is done, just that the ML codec emits less events. ---
**Author:** ![udaykirankona](https://avatars.discourse-cdn.com/v4/letter/u/ac91a4/32.png) [@udaykirankona](https://discuss.elastic.co/u/udaykirankona)\ **Post date:** [April 13, 2017, 9:08am UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/9 "2017-04-13T09:08:12Z")
Thanks Guyboertie for your reply ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 11, 2017, 9:20am UTC](https://discuss.elastic.co/t/how-to-improve-logstash-performance-imrpovement/80289/10 "2017-05-11T09:20:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.