We made some changes to our elasticsearch install (upgrading to 6, enabling beats, pipeline changes...) and the CPU usage of our logstash/elastic server has shot up:
The CPU% usage is roughly split between logstash and elasticsearch.
How can we instrument the stack to determine WHY it's using so much CPU (ingest rate of approximately 5K/s) and change how we're doing things (if possible) to use less CPU?