# Logstash CPU utilization is high **URL:** \ **Category:** Logstash\ **Created:** [May 22, 2018, 6:37am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727 "2018-05-22T06:37:37Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 22, 2018, 6:37am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/1 "2018-05-22T06:37:37Z")
Hi, I am using logstash 6.2.4 version. When I try to run any conf file at that time CPU utilization is high. So currently there is no conf file is running but still, CPU usages are high. I have attached a screenshot of the top command. Please guide us. ![lostash_top](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d7736b2cd4ae2c6d7b09c25689ffe05f2d324eee.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 22, 2018, 10:31am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/2 "2018-05-22T10:31:02Z")
No configuration file at all? Then Logstash might be in a crash loop since it won't start up properly but is constantly being restarted by systemd or whatever you're using. Make sure you have at least one configuration file. ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 22, 2018, 10:49am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/3 "2018-05-22T10:49:13Z")
Thanks for the reply. But on other Redhat system, I have used logstash.conf file for apache logs. That time also my CPU utilization is high so we thought will setup ELK on ubuntu machine and will try without any logstash.conf file. I have attached my apache access log conf file. ![conf](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f86b7b9c02b8c9c62b89dc467dbdc033a165f9b1.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 22, 2018, 1:03pm UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/4 "2018-05-22T13:03:04Z")
How many events per second is it processing? The CPU usage is proportional to the event rate, so looking at the CPU usage in isolation isn't useful. ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 22, 2018, 1:24pm UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/5 "2018-05-22T13:24:40Z")
Events means particular conf file or process? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 22, 2018, 1:40pm UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/6 "2018-05-22T13:40:06Z")
I don't understand the question. How many events (log messages) are you processing per second? ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 22, 2018, 2:49pm UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/7 "2018-05-22T14:49:44Z")
At a time I am running only one log file. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 22, 2018, 7:46pm UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/8 "2018-05-22T19:46:27Z")
"just one file" doesn't answer the question "what's the event rate?". ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 24, 2018, 6:05am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/9 "2018-05-24T06:05:07Z")
Hey, I have no idea how to check event rate? can you please give some command to check it? Thank you ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 24, 2018, 6:17am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/10 "2018-05-24T06:17:52Z")
Logstash's monitoring API should be able to help, or the metrics filter, or just manual measuring how long it takes to process a file with a given size. The exact figures aren't that important. If you're sending stuff to ES you'll probably get sufficiently good numbers if you just look at the time histogram of all events. ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 24, 2018, 6:27am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/11 "2018-05-24T06:27:57Z")
But right now I am not running any conf file but still cpu utilization is high. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 24, 2018, 9:28am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/12 "2018-05-24T09:28:48Z")
I repeat: No configuration file at all? Then Logstash might be in a crash loop since it won't start up properly but is constantly being restarted by systemd or whatever you're using. Make sure you have at least one configuration file. ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 24, 2018, 9:54am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/13 "2018-05-24T09:54:37Z")
There in a configuration file in /usr/share/logstash/bin directory. For logstash starting I am using systemctl restart/start logstash command. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 24, 2018, 10:59am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/14 "2018-05-24T10:59:50Z")
When run in that manner it most likely is looking for config files in /etc/logstash/conf.d. ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 24, 2018, 2:09pm UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/15 "2018-05-24T14:09:33Z")
Path is matter for cpu usage? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 24, 2018, 2:44pm UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/16 "2018-05-24T14:44:15Z")
No, the CPU usage isn't affected by the location of your configuration files. ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 25, 2018, 6:11am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/17 "2018-05-25T06:11:10Z")
Hey Magnusbaeck, Thank you for all your suggestion till yet. I have kept a conf file in /etc/logstash/conf.d directory but still my conf file is not running after systemctl restart logstash command. CPU usage is still going high. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 25, 2018, 6:15am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/18 "2018-05-25T06:15:27Z")
If you increase Logstash's logging verbosity it'll log exactly which configuration it loads (and more about what it does in general). ---
**Author:** ![mamta](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@mamta](https://discuss.elastic.co/u/mamta)\ **Post date:** [May 25, 2018, 6:20am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/19 "2018-05-25T06:20:54Z")
Hey Magnusbaeck, Sorry, but I am not getting what you want to say. I have just started ELK learning and setup. Please give some command or what changes is required in yaml file? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 25, 2018, 6:42am UTC](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727/20 "2018-05-25T06:42:25Z")
Change the `log.level` setting in logstash.yml, see [https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html](https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html). [Next page](https://discuss.elastic.co/t/logstash-cpu-utilization-is-high/132727.md?page=2)