Setup: Redis -> 6 Logstash instances (json codec, date mutate) -> elasticsearch
We have 6 Logstash instances pulling from Redis with a batch size of 1,000 for very small documents <1KB. We don't really do any processing on them, except mutate the date into the @timestamp field. Finally we output them to Elasticsearch in batch sizes of 10,000.
There is one period of the day where we will get about 4.5 million of these documents in our Redis queue and Logstash will chew through them. On 1.4.2 we would get on average 60-80k/second into Elasticsearch. On 1.5.0 we get only 40-60k/second into Elasticsearch. Same configuration and the only change being the version bump in Logstash.
Any idea what could be going on here?