# Logstash 2.3.4 memory leak **URL:** \ **Category:** Logstash\ **Created:** [August 13, 2016, 9:23am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969 "2016-08-13T09:23:30Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 13, 2016, 9:23am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/1 "2016-08-13T09:23:30Z")
Hi! I've been working on setting up ELK in AWS and been having this issue with Constantly increasing consumption of memory. I started out with 4GB then up to 10GB! But yes, it still consumed causing the logstash server to crash. restarting the server fixes the problem temporarily. But it just won't go away. I have a basic input configuration using the cloudwatch logs input [plugin](https://github.com/lukewaite/logstash-input-cloudwatch-logs). with 9 Log groups as inputs and uses logstash output plugins for elastic search. We use the elasticsearch server version 1.5 from AWS. Hope you guys can give a hint on how to fix the problem thanks! ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 13, 2016, 9:26am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/2 "2016-08-13T09:26:10Z")
By the way the Logstash server runs on top of "Ubuntu 16.04.1 LTS". Thanks! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 13, 2016, 10:58pm UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/3 "2016-08-13T22:58:16Z")
Providing your config would be helpful. ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 14, 2016, 3:14pm UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/4 "2016-08-14T15:14:25Z")
Hi Mark Walkom, Thanks for responding to my queries. Here is the basic config that I have: INPUTS: this is the same for 9 cloudwatch log groups ======================================================== input { cloudwatch\_logs { log\_group =\> "tomcatxxx\_server\_log" sincedb\_path =\> "/dev/null" interval=\> "300" region =\> "us-east-1" } } ======================================================================= OUTPUT: output{ elasticsearch { hosts =\> "[search-es-domain.us-east-1.es.amazonaws.com:80](http://search-es-domain.us-east-1.es.amazonaws.com:80)" ssl =\> false flush\_size =\> 700 } } Thanks! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 14, 2016, 9:30pm UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/5 "2016-08-14T21:30:45Z")
Can you expand on what you mean by memory leak? Is this exceeding the heap you are setting? ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 15, 2016, 8:19am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/6 "2016-08-15T08:19:17Z")
Hi Mark, Yes, it is exceeding the heap settings that I configured on the logstash server. I started with 2GB then 8GB and right now it's set to 10GB and it is consumed in just a span of 30 mins. Thanks! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 15, 2016, 10:10am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/7 "2016-08-15T10:10:06Z")
Is this JVM heap though, or other memory? Where are you seeing this? ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 15, 2016, 9:18pm UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/8 "2016-08-15T21:18:53Z")
On the OS memory usage. And when checking the service status of logstash in ubuntu. It shows the actual memory usage of the service. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 15, 2016, 10:07pm UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/9 "2016-08-15T22:07:23Z")
That's not JVM heap though, that's just the OS using all the available memory it can to make it performant as possible. Limiting that is outside the scope of these forums. ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 16, 2016, 1:46am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/10 "2016-08-16T01:46:54Z")
But restarting the logstash server, sets the memory back to normal value. I'm sure it has something to do with logstash server it self. Also logstash server is the only service running on the particular server. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 16, 2016, 1:55am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/11 "2016-08-16T01:55:57Z")
Logstash will only use what is in JVM heap. ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 16, 2016, 3:07am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/12 "2016-08-16T03:07:20Z")
So Is there any way to resolve the problem? The logstash server keeps on crushing right now. Thanks! ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 17, 2016, 12:27am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/13 "2016-08-17T00:27:01Z")
Anyone with the idea please? Thanks! ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 18, 2016, 1:07am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/14 "2016-08-18T01:07:09Z")
Anyone have an idea to resolved the memory leak?? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 18, 2016, 1:28am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/15 "2016-08-18T01:28:32Z")
You need to do something like this [https://www.google.com.au/?gws\_rd=ssl#q=linux+limit+process+memory](https://www.google.com.au/?gws_rd=ssl#q=linux+limit+process+memory) ---
**Author:** ![strike00](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@strike00](https://discuss.elastic.co/u/strike00)\ **Post date:** [August 18, 2016, 1:37am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/16 "2016-08-18T01:37:11Z")
I'll give it a try. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969/17 "2017-07-06T04:42:56Z")