How to improve Performance


I want to know which improves performance. I have two methods like below,

  1. single pipeline with single filter having multiple plugin.
    2.Single conf having multiple pipeline (multiple filter and multiple output)
    Thanks in advance.

I would say that depends on your inputs, config and outputs. Can you provide some additional details?

input {
beats {
host => "IP"
port => 5044
ssl => false
(for jws and jboss - used grok and mutate )
output {
elasticsearch {
hosts => ["IP:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"

If all your data comes in through the beats plugin on port 5044, the structure you outlined is probably the best.

Hi Dahlqvist,
Clarify me the performance impact of more filter and more pipeline.

If you are looking for guidance on performance tuning and optimisation for Logstash I would recommend the following:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.