# KV filter killing logstash performance

**URL:** <https://discuss.elastic.co/t/kv-filter-killing-logstash-performance/47817>\
**Category:** Logstash\
**Created:** [April 19, 2016, 5:04pm UTC](https://discuss.elastic.co/t/kv-filter-killing-logstash-performance/47817 "2016-04-19T17:04:52Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bblank](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@bblank](https://discuss.elastic.co/u/bblank)\
**Post date:** [April 19, 2016, 5:04pm UTC](https://discuss.elastic.co/t/kv-filter-killing-logstash-performance/47817/1 "2016-04-19T17:04:52Z")

</div>

We are using the kv filter in our logstash.conf file and it is causing performance issues. Changing workers, batch size and heap size don't appear to really make a difference. Our hardware is NOT under powered.

I need some suggestions on how to allocate more CPU to logstash otherwise we will have to abandon using the kv filter.

BTW - we are topping out at about 8K events per second. Without the KV filter we can sustain easily over 12K events per second.

Thanks! Bob.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 19, 2016, 6:11pm UTC](https://discuss.elastic.co/t/kv-filter-killing-logstash-performance/47817/2 "2016-04-19T18:11:32Z")

</div>

Which version of Logstash?

---

<div class="post-metadata">

**Author:** ![bblank](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@bblank](https://discuss.elastic.co/u/bblank)\
**Post date:** [April 19, 2016, 7:12pm UTC](https://discuss.elastic.co/t/kv-filter-killing-logstash-performance/47817/3 "2016-04-19T19:12:16Z")

</div>

Logstash version 2.1.1

---

<div class="post-metadata">

**Author:** ![bblank](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@bblank](https://discuss.elastic.co/u/bblank)\
**Post date:** [April 19, 2016, 7:34pm UTC](https://discuss.elastic.co/t/kv-filter-killing-logstash-performance/47817/4 "2016-04-19T19:34:19Z")

</div>

Sorry. Version is 2.2.2

---

<div class="post-metadata">

**Author:** ![bblank](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@bblank](https://discuss.elastic.co/u/bblank)\
**Post date:** [April 20, 2016, 4:45pm UTC](https://discuss.elastic.co/t/kv-filter-killing-logstash-performance/47817/5 "2016-04-20T16:45:05Z")

</div>

I am still digging into this... when we commented out the KV filter, our logstash server was running better. Now, with the filter out, it started to tank again. Something else is going on. Sorry about the false alarm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/kv-filter-killing-logstash-performance/47817/6 "2017-07-06T05:01:24Z")

</div>