# Logstash and elasticsearch performing **URL:** \ **Category:** Logstash\ **Created:** [December 16, 2016, 10:10am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279 "2016-12-16T10:10:18Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![pierre](https://avatars.discourse-cdn.com/v4/letter/p/d07c76/32.png) [@pierre](https://discuss.elastic.co/u/pierre)\ **Post date:** [December 16, 2016, 10:10am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/1 "2016-12-16T10:10:18Z")
hey , my configuration 40 G Ram, 2 CPU 4 core , elk and nginx in the same server il give 15g -Xmx for logstash and elactic input { file { start\_position =\> "beginning" path =\> "/var/log/StatVM/\*" sincedb\_path =\> "/dev/null" } } filter { grok { break\_on\_match =\> "false" match =\> { "message" =\> '%{DATA}%{DATE\_EU:Date};%{TIME:Time};%{NUMBER:Nombre}%{DATA}' } add\_field =\> { "timestamp" =\> "%{Date} %{Time}" } } date { match =\> ["timestamp", "dd MM YYYY HH:mm:ss"] } } output { elasticsearch { hosts =\> ["localhost:9200"] } } the size of the file is of 5G and when i do TOP i was ![](https://us1.discourse-cdn.com/elastic/original/2X/4/4445fa65d42f16930451c36128bff8c57b461a94.PNG) ---
**Author:** ![xavierfacq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavierfacq/32/8744_2.png) [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)\ **Post date:** [December 16, 2016, 11:08am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/2 "2016-12-16T11:08:11Z")
What is the question ? ---
**Author:** ![pierre](https://avatars.discourse-cdn.com/v4/letter/p/d07c76/32.png) [@pierre](https://discuss.elastic.co/u/pierre)\ **Post date:** [December 16, 2016, 11:33am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/3 "2016-12-16T11:33:08Z")
oh sorry , you can see my cpu 750% i don't undestand , in the documentation we can see up memory for up performance but java don't use this memory ... only CPU , so i must use many node ? what i have to do for up my performance ? ---
**Author:** ![xavierfacq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavierfacq/32/8744_2.png) [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)\ **Post date:** [December 16, 2016, 12:26pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/4 "2016-12-16T12:26:53Z")
Your logstash use all the CPU, maybe there is a lot of logs to parse from the beginning ? Else, ask the question on the logstash forum. ---
**Author:** ![pierre](https://avatars.discourse-cdn.com/v4/letter/p/d07c76/32.png) [@pierre](https://discuss.elastic.co/u/pierre)\ **Post date:** [December 19, 2016, 5:58pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/5 "2016-12-19T17:58:47Z")
up ! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 20, 2016, 7:00am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/6 "2016-12-20T07:00:15Z")
What's the message rate through Logstash? ---
**Author:** ![pierre](https://avatars.discourse-cdn.com/v4/letter/p/d07c76/32.png) [@pierre](https://discuss.elastic.co/u/pierre)\ **Post date:** [December 20, 2016, 9:13am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/7 "2016-12-20T09:13:12Z")
That is to say, can you develop, i begining ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 20, 2016, 9:30am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/8 "2016-12-20T09:30:17Z")
How many messages is Logstash processing per second? If it's processing thousands of messages every second it's not surprising if it uses a lot of CPU. ---
**Author:** ![pierre](https://avatars.discourse-cdn.com/v4/letter/p/d07c76/32.png) [@pierre](https://discuss.elastic.co/u/pierre)\ **Post date:** [December 20, 2016, 9:38am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/9 "2016-12-20T09:38:09Z")
yes, Hundred thousand and I can have losses ? between logstash and ES ? does he exist a cluster for logstash ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 20, 2016, 10:08am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/10 "2016-12-20T10:08:56Z")
> Hundred thousand Per second? > and I can have losses ? between logstash and ES ? There are cases when that can occur. > does he exist a cluster for logstash ? Not in the same sense as Elasticsearch, but you can distribute load to multiple Logstash instances either by sending the events to a message broker than any number of Logstash instances can read from, or you can use a load balancer in front of the Logstash instances. ---
**Author:** ![pierre](https://avatars.discourse-cdn.com/v4/letter/p/d07c76/32.png) [@pierre](https://discuss.elastic.co/u/pierre)\ **Post date:** [December 20, 2016, 10:34am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/11 "2016-12-20T10:34:01Z")
> [@magnusbaeck](#): > > Hundred thousand no sorry just thousand > [@magnusbaeck](#): > > and I can have losses ? between logstash and ES ? in which case > [@magnusbaeck](#): > > Not in the same sense as Elasticsearch, but you can distribute load to > multiple Logstash instances either by sending the events to a message > broker than any number of Logstash instances can read from, or you can > use a load balancer in front of the Logstash instances. can you give me some solution or explication ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 20, 2016, 10:37am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/12 "2016-12-20T10:37:17Z")
> can you give me some solution or explication > **[Deploying and Scaling Logstash | Logstash Reference \[5.1\] | Elastic](https://www.elastic.co/guide/en/logstash/5.1/deploying-and-scaling.html#deploying-minimal-install)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 17, 2017, 10:37am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-performing/69279/13 "2017-01-17T10:37:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.