KV filter killing logstash performance

Elastic Stack Logstash
1

We are using the kv filter in our logstash.conf file and it is causing performance issues. Changing workers, batch size and heap size don't appear to really make a difference. Our hardware is NOT under powered.

I need some suggestions on how to allocate more CPU to logstash otherwise we will have to abandon using the kv filter.

BTW - we are topping out at about 8K events per second. Without the KV filter we can sustain easily over 12K events per second.

Thanks! Bob.

2

Which version of Logstash?

3

Logstash version 2.1.1

4

Sorry. Version is 2.2.2

5

I am still digging into this... when we commented out the KV filter, our logstash server was running better. Now, with the filter out, it started to tank again. Something else is going on. Sorry about the false alarm.