# Logstash goes to 100% cpu and stops logging after a while

**URL:** <https://discuss.elastic.co/t/logstash-goes-to-100-cpu-and-stops-logging-after-a-while/42182>\
**Category:** Logstash\
**Created:** [February 18, 2016, 7:16pm UTC](https://discuss.elastic.co/t/logstash-goes-to-100-cpu-and-stops-logging-after-a-while/42182 "2016-02-18T19:16:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![linuxgurugamer](https://avatars.discourse-cdn.com/v4/letter/l/a9adbd/32.png) [@linuxgurugamer](https://discuss.elastic.co/u/linuxgurugamer)\
**Post date:** [February 18, 2016, 7:16pm UTC](https://discuss.elastic.co/t/logstash-goes-to-100-cpu-and-stops-logging-after-a-while/42182/1 "2016-02-18T19:16:56Z")

</div>

Logstash 2.2.1 is installed on a CentOS 6 system

Server has 4 gig memory, and 4 CPUs

Logs come into the server via rsyslog, local rsyslog sends to local port 5544

It works fine for a while, then it goes to 100% cpu on 2 cpus (today it was 3), and after a while it just stops logging. It doesn't respond to a simple "service logstash stop", I have to kill -9 the process

There are only two simple grok filters, one for apache and one for nginx.

I did verify that logs were coming into the server by putting a rule into rsyslog to write the logs to a local file as well

Any ideas?

02-syslog-input.conf  
input {  
tcp {  
port =\> 5544  
type =\> syslog  
}  
udp {  
port =\> 5544  
type =\> syslog  
}  
}

```
filter {
  # This replaces the host field (UDP source) with the host that generated the message (sysloghost)
  if [sysloghost] {
    mutate {
      replace => ["host", "%{sysloghost}"]
      remove_field => "sysloghost" # prune the field after successfully replacing "host"
    }
  }
}

```

13-apache.conf  
#  
# Grok both the standard apache combined log and our modified version  
#  
filter{  
if[type] == "syslog" and [message] =~ "apache" {  
grok {  
match =\> [  
"message", "%{COMBINEDAPACHELOG}" ,  
"message", "%{COMBINEDAPACHELOG2}",  
# "message", "%{APACHE\_ERROR\_LOG}",  
"message", "%{SSLCOMBINEDAPACHELOG2}"  
]

```
		}
		date {
			match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
		}
	}
}

```

13-nginx.conf  
#  
# Grok our nginx logs  
#  
filter{  
#if[type] == "nginx-access" {  
if[type] == "syslog" and [message] =~ "nginx" {  
grok {  
patterns\_dir =\> ["/opt/logstash/patterns", "/opt/logstash/extra\_patterns"]  
match =\> [  
"message", "%{IPORHOST:http\_host} %{IPORHOST:client\_ip} [%{HTTPDATE:timestamp}] "(?:%{WORD:http\_verb} %{NOTSPACE:http\_request}(?: HTTP/%{NUMBER:http\_version})?|%{DATA:raw\_http\_request})" %{NUMBER:http\_status\_code} (?:%{NUMBER:bytes\_read}|-) %{QS:referrer} %{QS:agent} %{NUMBER:time\_duration:float} %{NUMBER:time\_backend\_response:float}",  
"message", "%{IPORHOST:http\_host} %{IPORHOST:client\_ip} [%{HTTPDATE:timestamp}] "(?:%{WORD:http\_verb} %{NOTSPACE:http\_request}(?: HTTP/%{NUMBER:http\_version})?|%{DATA:raw\_http\_request})" %{NUMBER:http\_status\_code} (?:%{NUMBER:bytes\_read}|-) %{QS:referrer} %{QS:agent} %{NUMBER:time\_duration:float}",  
"message", "%{NGINXACCESS}"  
]  
add\_field =\> ["received\_at", "%{@timestamp}"]  
}  
}  
}

30-elasticsearch-output.conf  
output {  
elasticsearch { hosts =\> ["elasticsearch32:9200"] }  
#stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/logstash-goes-to-100-cpu-and-stops-logging-after-a-while/42182/2 "2017-07-06T05:10:48Z")

</div>

Closed on July 6, 2017, 5:10am UTC