We are using the kv filter in our logstash.conf file and it is causing performance issues. Changing workers, batch size and heap size don't appear to really make a difference. Our hardware is NOT under powered.
I need some suggestions on how to allocate more CPU to logstash otherwise we will have to abandon using the kv filter.
BTW - we are topping out at about 8K events per second. Without the KV filter we can sustain easily over 12K events per second.
Thanks! Bob.