# Logstash heap size vs. Elasticsearch heap size **URL:** \ **Category:** Logstash\ **Created:** [May 29, 2018, 10:48am UTC](https://discuss.elastic.co/t/logstash-heap-size-vs-elasticsearch-heap-size/133662 "2018-05-29T10:48:18Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![dr01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dr01/32/8482_2.png) [@dr01](https://discuss.elastic.co/u/dr01)\ **Post date:** [May 29, 2018, 10:48am UTC](https://discuss.elastic.co/t/logstash-heap-size-vs-elasticsearch-heap-size/133662/1 "2018-05-29T10:48:19Z")
Hello, As a rule of thumb, does it make sense to set a Logstash heap size equal (or proportional) to the Elasticsearch heap size, or there are other factors to take into consideration? For instance, would an ELK stack installation where the Logstash heap size is 1/5 of the ES heap size be recommended? Thanks in advance. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 29, 2018, 10:57am UTC](https://discuss.elastic.co/t/logstash-heap-size-vs-elasticsearch-heap-size/133662/2 "2018-05-29T10:57:04Z")
There's no correlation between the two. Logstash should really only need a few GB at most, just enough to deal with messages it holds in its internal queue while processing. ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 29, 2018, 11:19am UTC](https://discuss.elastic.co/t/logstash-heap-size-vs-elasticsearch-heap-size/133662/3 "2018-05-29T11:19:33Z")
There is much more that affects Logstash's use of JVM heap than just its internal queue. If you are doing any of the following you will increase your need for JVM heap... - starting multiple pipelines (in 6.x and later) - increasing input buffers and workers to better handle bursts of incoming data without packet loss (a MUST-HAVE when using any UDP-based input) - doing a lot of enrichment and using the caching capabilities of these filters for increased performance (DNS, GeoIP, and others) - using the translate filter to make data more human-friendly with lots of, or even a few large, dictionaries If you are doing ALL of the above it is even possible that the JVM heap requirements of Logstash might even exceed those of Elasticsearch. Just yesterday we had to bump up a Logstash instance from 6GB to 8GB as it was exhausting the JVM heap. It is a small price to pay for producing truly high-quality data at very high event rates. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 26, 2018, 11:19am UTC](https://discuss.elastic.co/t/logstash-heap-size-vs-elasticsearch-heap-size/133662/4 "2018-06-26T11:19:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.