# Is logstash forwarder expected to be slower than logstash?

**URL:** <https://discuss.elastic.co/t/is-logstash-forwarder-expected-to-be-slower-than-logstash/26885>\
**Category:** Logstash\
**Created:** [August 5, 2015, 11:57am UTC](https://discuss.elastic.co/t/is-logstash-forwarder-expected-to-be-slower-than-logstash/26885 "2015-08-05T11:57:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zpp](https://avatars.discourse-cdn.com/v4/letter/z/54ee81/32.png) [@zpp](https://discuss.elastic.co/u/zpp)\
**Post date:** [August 5, 2015, 11:57am UTC](https://discuss.elastic.co/t/is-logstash-forwarder-expected-to-be-slower-than-logstash/26885/1 "2015-08-05T11:57:58Z")

</div>

At the beginning, I set up a logstash service on windows to monitor all files in one folder. The service runs fine, data feeding to elasticsearch through redis is up to date and good. The only drawback is the cpu and memory usage. Then i switched to use logstash-forwarder, yes, it uses little cpu, however, it's lagging behind greatly (data fed to elastic seach is not up to date), is this the expected behavior? LSF is slower than logstash?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 7, 2015, 2:04am UTC](https://discuss.elastic.co/t/is-logstash-forwarder-expected-to-be-slower-than-logstash/26885/2 "2015-08-07T02:04:12Z")

</div>

It shouldn't be.  
What does the stack architecture look like?

---

<div class="post-metadata">

**Author:** ![zpp](https://avatars.discourse-cdn.com/v4/letter/z/54ee81/32.png) [@zpp](https://discuss.elastic.co/u/zpp)\
**Post date:** [August 11, 2015, 2:03am UTC](https://discuss.elastic.co/t/is-logstash-forwarder-expected-to-be-slower-than-logstash/26885/3 "2015-08-11T02:03:47Z")

</div>

For logstash:  
logstash -\> redis -\> logstash -\> elastic search  
--Filter plugins are configured at shipper side

For LSF:  
LSF -\> logstash -\> elastic search  
--Filters are at logstash

maybe the box running logstash(indexer) and elastic search not powerful enough?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 11, 2015, 2:42am UTC](https://discuss.elastic.co/t/is-logstash-forwarder-expected-to-be-slower-than-logstash/26885/4 "2015-08-11T02:42:20Z")

</div>

Are they going to the same ES instances?

---

<div class="post-metadata">

**Author:** ![zpp](https://avatars.discourse-cdn.com/v4/letter/z/54ee81/32.png) [@zpp](https://discuss.elastic.co/u/zpp)\
**Post date:** [August 11, 2015, 3:50am UTC](https://discuss.elastic.co/t/is-logstash-forwarder-expected-to-be-slower-than-logstash/26885/5 "2015-08-11T03:50:52Z")

</div>

yes, they are.

Redis, indexer, and elastic search are on the same server. For the LSF configuration, I simply changed the indexer to use the lumberjack input rather than redis.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/is-logstash-forwarder-expected-to-be-slower-than-logstash/26885/6 "2017-07-06T05:32:25Z")

</div>