# Logstash As Side Car Container
**URL:** https://discuss.elastic.co/t/logstash-as-side-car-container/82982
**Category:** Logstash
**Created:** [April 20, 2017, 5:36am UTC](https://discuss.elastic.co/t/logstash-as-side-car-container/82982 "2017-04-20T05:36:19Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Java\_Padawan](https://discuss.elastic.co/u/Java_Padawan)
#### Post date: [April 20, 2017, 5:36am UTC](https://discuss.elastic.co/t/logstash-as-side-car-container/82982/1 "2017-04-20T05:36:19Z")
I've been using logstash 2.x as a side car for a microservice container. And I facing an issue where it consumes a lot of resources. 1.4GB Ram and almost 2000 millicores for one of the most active microservice.
Not giving up on the approach, I tried to upgrade to 5.3, which is even worse. It slows down to a crawl on default settings.
Should I keep using the approach or should I sue filebeat side car container and a cluster of logstash containers?
And any suggested design that is already battle tested?
Updated:
Filebeat is the last option, as it requires us to create another infrastructure for logstash that supports different types of filters.
Also, I think the logstash 5.3 crashing might be caused by this exception. Running it in openshift
[2017-04-20T01:28:58,248][DEBUG][logstash.instrument.periodicpoller.cgroup] Erro
r, cannot retrieve cgroups information {:exception=\>"Errno::ENOENT", :message=\>"
No such file or directory - /sys/fs/cgroup/cpuacct/system.slice/docker-d53ade74e
71e495bfafd276db5e2cb30f3e80674436937452a77868711f5f833.scope/cpuacct.usage"}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2017, 5:40am UTC](https://discuss.elastic.co/t/logstash-as-side-car-container/82982/2 "2017-04-20T05:40:32Z")
If Logstash consumes too much resources and you're only using it to read files, use Filebeat instead.
---
### Author:  [@Java\_Padawan](https://discuss.elastic.co/u/Java_Padawan)
#### Post date: [April 26, 2017, 6:47pm UTC](https://discuss.elastic.co/t/logstash-as-side-car-container/82982/3 "2017-04-26T18:47:10Z")
Filebeats is an option, but we do use some transformation and a bit of processing (clone, drops and mutates).
Any thoughts on how to calculate the optimum logstash configuration based on input rate?
I don't want to do trial and errors as each POD I am managing have different behaviors.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 27, 2017, 5:15am UTC](https://discuss.elastic.co/t/logstash-as-side-car-container/82982/4 "2017-04-27T05:15:05Z")
> Filebeats is an option, but we do use some transformation and a bit of processing (clone, drops and mutates).
Right, but that could be done in a single Logstash instance, possibly on another machine.
> Any thoughts on how to calculate the optimum logstash configuration based on input rate?
There are probably a number of JVM options to tweak, but apart from that here's isn't that much you can do.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2017, 5:18am UTC](https://discuss.elastic.co/t/logstash-as-side-car-container/82982/5 "2017-05-25T05:18:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.