How to improve Performance

Elastic Stack Logstash
1

Hi,

I want to know which improves performance. I have two methods like below,

  1. single pipeline with single filter having multiple plugin.
    2.Single conf having multiple pipeline (multiple filter and multiple output)
    Thanks in advance.
2

I would say that depends on your inputs, config and outputs. Can you provide some additional details?

3

Sure.
input {
beats {
host => "IP"
port => 5044
ssl => false
}
}
filter{
(for jws and jboss - used grok and mutate )
}
output {
elasticsearch {
hosts => ["IP:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

4

If all your data comes in through the beats plugin on port 5044, the structure you outlined is probably the best.

5

Hi Dahlqvist,
Clarify me the performance impact of more filter and more pipeline.

6

If you are looking for guidance on performance tuning and optimisation for Logstash I would recommend the following:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.