# Logstash-filter-metrics used 100% CPU?

**URL:** <https://discuss.elastic.co/t/logstash-filter-metrics-used-100-cpu/79765>\
**Category:** Logstash\
**Created:** [March 23, 2017, 3:38pm UTC](https://discuss.elastic.co/t/logstash-filter-metrics-used-100-cpu/79765 "2017-03-23T15:38:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![srdegeus](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@srdegeus](https://discuss.elastic.co/u/srdegeus)\
**Post date:** [March 23, 2017, 3:38pm UTC](https://discuss.elastic.co/t/logstash-filter-metrics-used-100-cpu/79765/1 "2017-03-23T15:38:15Z")

</div>

I wanted to get an idication of the ingest speed of logstash and found that the (buildin) plugin [logstash-filter-metrics](https://www.elastic.co/guide/en/logstash/current/plugins-filters-metrics.html) could do this.

After adding the example code to my config file, logstash starts printing a rate of 20000+ and consuming 100% CPU

I tried with just the example code, but this has the same behaviour. It starts using 100% CPU (on all 4 CPUs)

Is this expected behaviour? Am I missing something?

I did not change any config except setting JAVA\_HOME to C:\Program Files\Java\jre1.8.0\_121

I am running this on Windows Server 2016 (4 CPU, 4GB mem) :  
D:\ELK\logstash\>bin\logstash.bat -V  
Could not find log4j2 configuration at path /ELK/logstash/config/log4j2.properties. Using default config which logs to console  
logstash 5.2.2  
jruby 1.7.25 (1.9.3p551) 2016-04-13 867cb81 on Java HotSpot(TM) 64-Bit Server VM 1.8.0\_121-b13 +jit [Windows NT (unknown)-amd64]  
java 1.8.0\_121 (Oracle Corporation)  
jvm Java HotSpot(TM) 64-Bit Server VM / 25.121-b13

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 23, 2017, 3:46pm UTC](https://discuss.elastic.co/t/logstash-filter-metrics-used-100-cpu/79765/2 "2017-03-23T15:46:03Z")

</div>

If there is nothing upstream or downstream that is limiting throughput, Logstash performance is generally limited by the amount of CPU available. Assuming your simple test has no inputs or outputs affecting performance, it is natural for Logstash to saturate the CPUs of the host at maximum throughput.

---

<div class="post-metadata">

**Author:** ![srdegeus](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@srdegeus](https://discuss.elastic.co/u/srdegeus)\
**Post date:** [March 24, 2017, 3:11pm UTC](https://discuss.elastic.co/t/logstash-filter-metrics-used-100-cpu/79765/3 "2017-03-24T15:11:47Z")

</div>

I used the simple test as it is on the [logstash-filter-metrics](https://www.elastic.co/guide/en/logstash/current/plugins-filters-metrics.html) page

```
input {
  generator {
    type => "generated"
  }
}

filter {
  if [type] == "generated" {
    metrics {
      meter => "events"
      add_tag => "metric"
    }
  }
}

output {
  # only emit events with the 'metric' tag
  if "metric" in [tags] {
    stdout {
      codec => line {
        format => "rate: %{[events][rate_1m]}"
      }
    }
  }
}

```

What I didn't realise is that the

```
input {
  generator {
    type => "generated"
  }
}

```

Generates random "events" (as fast as it can go) and that those are being measured.

It took a bit of trial and error to get my throughput measured as it doesn't seem to work on the default "message" field.  
I think the following would be a nice example as this doesn't use 100% CPU, but measures how fast you press the enter key:

```
input {
  stdin {
    #Set a type so we can identify this pipeline
    type => "keyboard_input"
    #add a field where we can measure against.
    add_field => ["fieldname", "value"]
  }
}

filter {
  if [type] == "keyboard_input" {
    metrics {
      meter => "fieldname"
      add_tag => "metric"
    }
  }
}

output {
  # only emit events with the 'metric' tag
  if "metric" in [tags] {
    stdout {
      codec => line {
        format => "rate: %{[fieldname][rate_1m]} count: %{[fieldname][count]}"
      }
    }
  }
}

```

I included this for future reference.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2017, 3:12pm UTC](https://discuss.elastic.co/t/logstash-filter-metrics-used-100-cpu/79765/4 "2017-04-21T15:12:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.