Logstash high CPU % on startup ~ 190%

Elastic Stack Logstash
1

I installed a fresh instance of Logstash with basic configurations for testing (no filters) just an input and an output. As soon as I start Logstash the CPU percentage shoots up to ~200%. Is this the normal behavior for starting logstash? What are some tuning suggestions that you can provide, I'm running out of ideas. Your help is greatly appreciated.

Here are the specs:
Logstash version - 6.5.0 and 6.5.2
OS - Redhat Linux 7.5
4 CPU Core and 8GB of RAM

Logstash.conf
input {
stdin{}
}

output {
stdout{
codec => rubydebug
}
}

command used to start Logstash
./logstash -f logstash.conf

2

When I start logstash it burns about 50 seconds of CPU before it is ready to do anything. So this sounds normal.

3

@badger, after Logstash starts, the CPU% percentage does go down to about 40%, but if there is a sudden burst of input logs.... the CPU shoots up again to about 130% before it normalizes at about 70% which is still pretty high.

In an environment where incident would get created for high CPU this would cause a lot of alerts.

Are you experiencing the same behavior? Any recommendations? I'm looking to hear from a few experts here on the forum.

4

If it is not processing anything I would not expect it to use any CPU unless you have inputs that run on a scheduler. If logs are available to process then by default it will use as many threads as you have CPUs, so it could conceivably max out every CPU if the filters are complex. However, with the configuration you show I would not expect it to use much CPU.

Take a look at the monitoring APIs. In particular the stats/process and hot-threads requests.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.