sorry if this is already handled in another topic here, i did not find any matching.
Last week we installed logstash on a new physical server, that have 28(+28 Multithreading) CPU Threads and 64GB RAM.
First off we run version 1.5.6 of logstash.
We configured to run multiple instances of logstash with different configs, to make the admin life a bit easier
The config of the problematic instance include tcp inputs as well as grok,prune,drop,mutate,geoip,ruby filters and elasticsearch/zabbix output (it is quite long and complex so i did not post it here, if it is usefull pls tell me)
The elasticsearch output is configured with
workers => 50
and the instance get started with
to give it 50 filter workers.
If the loads increase and it reaches 20 CPU Threads (or a usage of 2000%) it stops allocating more resources and runs with the 20 Threads, although there are over 30 idle threads around.
Is there anything i did oversee? Is the one of the filter (maybe ruby) not fully multithreading able?
Any feedback is appreciated.