# Logstash is restarting automatucally with high CPU usage

**URL:** <https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617>\
**Category:** Logstash\
**Created:** [August 27, 2020, 12:31pm UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617 "2020-08-27T12:31:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar/32/69244_2.png) [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\
**Post date:** [August 27, 2020, 12:31pm UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617/1 "2020-08-27T12:31:46Z")

</div>

Hi,

i am trying to run logstash using the below command.

`sudo systemctl start logstash.service`

From below logs we can see that logstash service is started than it is stopped and restarted again.

```auto
 [2020-08-27T11:56:24,818][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.9.0", "jruby.version"=>"jruby 9.2.12.0 (2.5.7) 2020-07-01 db01a49ba6 OpenJDK 64-Bit Server VM 11.0.7+10-LTS on 11.0.7+10-LTS +indy +jit [linux-aarch64]"}
    [2020-08-27T11:56:25,727][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
    [2020-08-27T11:56:28,646][INFO][org.reflections.Reflections] Reflections took 66 ms to scan 1 urls, producing 22 keys and 45 values 
    [2020-08-27T11:56:29,745][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/test.conf"], :thread=>"#<Thread:0xe2ff429 run>"}
    [2020-08-27T11:56:31,064][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>1.27}
    [2020-08-27T11:56:31,180][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"}
    [2020-08-27T11:56:31,316][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
    [2020-08-27T11:56:31,820][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
    [2020-08-27T11:56:32,084][INFO][logstash.runner] Logstash shut down.
    [2020-08-27T11:57:05,997][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.9.0", "jruby.version"=>"jruby 9.2.12.0 (2.5.7) 2020-07-01 db01a49ba6 OpenJDK 64-Bit Server VM 11.0.7+10-LTS on 11.0.7+10-LTS +indy +jit [linux-aarch64]"}

```

when i checkd the CPU usage it was more than 300%.

 ![logstash](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f8e116959f43c8ca92c49077e15c206b87e17a47.png)

Here are some of my configs.

jvm.options file content

```auto
    ## JVM configuration

    # Xms represents the initial size of total heap space
    # Xmx represents the maximum size of total heap space

    -Xms4g
    -Xmx4g

    ################################################################
    ## Expert settings
    ################################################################
    ##
    ## All settings below this section are considered
    ## expert settings. Don't tamper with them unless
    ## you understand what you are doing
    ##
    ################################################################

    ## GC configuration
    -XX:+UseConcMarkSweepGC
    -XX:CMSInitiatingOccupancyFraction=75
    -XX:+UseCMSInitiatingOccupancyOnly

    ## Locale
    # Set the locale language
    #-Duser.language=en

    # Set the locale country
    #-Duser.country=US

    # Set the locale variant, if any
    #-Duser.variant=

    ## basic

    # set the I/O temp directory
    #-Djava.io.tmpdir=$HOME

    # set to headless, just in case
    -Djava.awt.headless=true

    # ensure UTF-8 encoding by default (e.g. filenames)
    -Dfile.encoding=UTF-8

    # use our provided JNA always versus the system one
    #-Djna.nosys=true

    # Turn on JRuby invokedynamic
    -Djruby.compile.invokedynamic=true
    # Force Compilation
    -Djruby.jit.threshold=0
    # Make sure joni regexp interruptability is enabled
    -Djruby.regexp.interruptible=true

    ## heap dumps

    # generate a heap dump when an allocation from the Java heap fails
    # heap dumps are created in the working directory of the JVM
    -XX:+HeapDumpOnOutOfMemoryError

    # specify an alternative path for heap dumps
    # ensure the directory exists and has sufficient space
    #-XX:HeapDumpPath=${LOGSTASH_HOME}/heapdump.hprof

    ## GC logging
    #-XX:+PrintGCDetails
    #-XX:+PrintGCTimeStamps
    #-XX:+PrintGCDateStamps
    #-XX:+PrintClassHistogram
    #-XX:+PrintTenuringDistribution
    #-XX:+PrintGCApplicationStoppedTime

    # log GC status to a file with time stamps
    # ensure the directory exists
    #-Xloggc:${LS_GC_LOG_FILE}

    # Entropy source for randomness
    -Djava.security.egd=file:/dev/urandom

    # Copy the logging context from parent threads to children
    -Dlog4j2.isThreadContextMapInheritable=true

```

content of /conf.d/test.conf

```auto
    input {
    stdin { }
    }
    output {
      stdout { codec => rubydebug }
    }

```

pipelines.yml file content

```auto
# This file is where you define your pipelines. You can define multiple.
# For more information on multiple pipelines, see the documentation:
# https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html

- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"

```

logstash.yml file content

```auto
# Settings file in YAML
#
# Settings can be specified either in hierarchical form, e.g.:
#
   pipeline:
     batch:
       size: 125
       delay: 5
#
# Or as flat keys:
#
   pipeline.batch.size: 125
   pipeline.batch.delay: 5
#
# ------------ Node identity ------------
#
# Use a descriptive name for the node:
#
 node.name: test
#
# If omitted the node name will default to the machine's host name
#
# ------------ Data path ------------------
#
# Which directory should be used by logstash and its plugins
# for any persistent needs. Defaults to LOGSTASH_HOME/data
#
path.data: /var/lib/logstash
#
# ------------ Pipeline Settings --------------
#
# The ID of the pipeline.
#
 pipeline.id: main
#
# Set the number of workers that will, in parallel, execute the filters+outputs
# stage of the pipeline.
#
# This defaults to the number of the host's CPU cores.
#
 pipeline.workers: 2
# How many events to retrieve from inputs before sending to filters+workers
#
 pipeline.batch.size: 125
#
# How long to wait in milliseconds while polling for the next event
# before dispatching an undersized batch to filters+outputs
#
 pipeline.batch.delay: 50
#
# Force Logstash to exit during shutdown even if there are still inflight
# events in memory. By default, logstash will refuse to quit until all
# received events have been pushed to the outputs.
#
# WARNING: enabling this can lead to data loss during shutdown
#
# pipeline.unsafe_shutdown: false
#
# Set the pipeline event ordering. Options are "auto" (the default), "true" or "false".
# "auto" will automatically enable ordering if the 'pipeline.workers' setting
# is also set to '1'.
# "true" will enforce ordering on the pipeline and prevent logstash from starting
# if there are multiple workers.
# "false" will disable any extra processing necessary for preserving ordering.
#
pipeline.ordered: auto
#
# ------------ Pipeline Configuration Settings --------------
#
# Where to fetch the pipeline configuration for the main pipeline
#
path.config: /etc/logstash/conf.d/*.conf
#
# Pipeline configuration string for the main pipeline
#
# config.string:
#
# At startup, test if the configuration is valid and exit (dry run)
#
# config.test_and_exit: false
# Periodically check if the configuration has changed and reload the pipeline
# This can also be triggered manually through the SIGHUP signal
#
# config.reload.automatic: false
#
# How often to check if the pipeline configuration has changed (in seconds)
# Note that the unit value (s) is required. Values without a qualifier (e.g. 60) 
# are treated as nanoseconds.
# Setting the interval this way is not recommended and might change in later versions.
#
# config.reload.interval: 3s
#
# Show fully compiled configuration as debug log message
# NOTE: --log.level must be 'debug'
#
 config.debug: true

# When enabled, process escaped characters such as \n and \" in strings in the
# pipeline configuration files.
#
# config.support_escapes: false
#
# ------------ HTTP API Settings -------------
# Define settings related to the HTTP API here.
#
# The HTTP API is enabled by default. It can be disabled, but features that rely
# on it will not work as intended.
# http.enabled: true
#
# By default, the HTTP API is bound to only the host's local loopback interface,
# ensuring that it is not accessible to the rest of the network. Because the API
# includes neither authentication nor authorization and has not been hardened or
# tested for use as a publicly-reachable API, binding to publicly accessible IPs
# should be avoided where possible.
#
# http.host: 127.0.0.1
#
# The HTTP API web server will listen on an available port from the given range.
# Values can be specified as a single port (e.g., `9600`), or an inclusive range
# of ports (e.g., `9600-9700`).
#
# http.port: 9600-9700
#
# ------------ Module Settings ---------------
# Define modules here. Modules definitions must be defined as an array.
# The simple way to see this is to prepend each `name` with a `-`, and keep
# all associated variables under the `name` they are associated with, and
# above the next, like this:
#
# modules:
# - name: MODULE_NAME
# var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE
# var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE
# var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE
# var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE
#
# Module variable names must be in the format of
#
# var.PLUGIN_TYPE.PLUGIN_NAME.KEY
#
# modules:
#
# ------------ Cloud Settings ---------------
# Define Elastic Cloud settings here.
# and it may have an label prefix e.g. staging:dXMtZ...
# This will overwrite 'var.elasticsearch.hosts' and 'var.kibana.host'
# cloud.id: <identifier>
#
# Format of cloud.auth is: <user>:<pass>
# This is optional
# If supplied this will overwrite 'var.elasticsearch.username' and 'var.elasticsearch.password'
# If supplied this will overwrite 'var.kibana.username' and 'var.kibana.password'
# cloud.auth: elastic:<password>
# ------------ Queuing Settings --------------
#
# Internal queuing model, "memory" for legacy in-memory based queuing and
# "persisted" for disk-based acked queueing. Defaults is memory
#
# queue.type: memory
#
# If using queue.type: persisted, the directory path where the data files will be stored.
# Default is path.data/queue
#
# path.queue:
#
# If using queue.type: persisted, the page data files size. The queue data consists of
# append-only data files separated into pages. Default is 64mb
#
# queue.page_capacity: 64mb
#
# If using queue.type: persisted, the maximum number of unread events in the queue.
# Default is 0 (unlimited)
#
# queue.max_events: 0
#
# If using queue.type: persisted, the total capacity of the queue in number of bytes.
# If you would like more unacked events to be buffered in Logstash, you can increase the
# capacity using this setting. Please make sure your disk drive has capacity greater than
# the size specified here. If both max_bytes and max_events are specified, Logstash will pick
# whichever criteria is reached first
# Default is 1024mb or 1gb
#
# queue.max_bytes: 1024mb
#
# If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.acks: 1024
#
# If using queue.type: persisted, the maximum number of written events before forcing a checkpoint
# Default is 1024, 0 for unlimited
# queue.checkpoint.writes: 1024
#
# If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page
# Default is 1000, 0 for no periodic checkpoint.
#
# queue.checkpoint.interval: 1000
#
# ------------ Dead-Letter Queue Settings --------------
# Flag to turn on dead-letter queue.
#
# dead_letter_queue.enable: false

# If using dead_letter_queue.enable: true, the maximum size of each dead letter queue. Entries
# will be dropped if they would increase the size of the dead letter queue beyond this setting.
# Default is 1024mb
# dead_letter_queue.max_bytes: 1024mb

# If using dead_letter_queue.enable: true, the directory path where the data files will be stored.
# Default is path.data/dead_letter_queue
#
# path.dead_letter_queue:
#
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
# http.host: "127.0.0.1"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700
#
# ------------ Debugging Settings --------------
#
# Options for log.level:
# * fatal
# * error
# * warn
# * info (default)
# * debug
# * trace
#
 log.level: debug
path.logs: /var/log/logstash
#
# ------------ Other Settings --------------
#
# Where to find custom plugins
# path.plugins: []
#
# Flag to output log lines of each pipeline in its separate log file. Each log filename contains the pipeline.name
# Default is false
# pipeline.separate_logs: false

```

i tried few solutions mentioned in other similar post but no luck. Can anyone help me with this issue?

---

<div class="post-metadata">

**Author:** ![karthiknpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karthiknpy/32/53587_2.png) [@karthiknpy](https://discuss.elastic.co/u/karthiknpy)\
**Post date:** [August 27, 2020, 1:29pm UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617/2 "2020-08-27T13:29:30Z")

</div>

Hi Tirtharaj,

Could you please post more details ?

Show the contents of pipelines,yml, JVM.options, logstash.yml

Regards  
Karthik.K

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 27, 2020, 3:21pm UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617/3 "2020-08-27T15:21:17Z")

</div>

Starting logstash is very expensive. If it starts and immediately stops I would expect the CPU to be high. What does your configuration look like?

---

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar/32/69244_2.png) [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\
**Post date:** [August 28, 2020, 6:23am UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617/4 "2020-08-28T06:23:47Z")

</div>

I have update the post with configuration files. Please have a look.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 28, 2020, 3:32pm UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617/5 "2020-08-28T15:32:00Z")

</div>

> [@Tirtharaj\_Karbotkar](#):
>
> ```auto
> input {
> stdin { }
> }
> 
> ```

If you are running as a service it would not surprise me if stdin is linked to /dev/null, in which case the input will shutdown the logstash process as soon as it starts (exactly what you are seeing). Use a different input.

---

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar/32/69244_2.png) [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\
**Post date:** [September 8, 2020, 10:39am UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617/6 "2020-09-08T10:39:50Z")

</div>

thanks for your reply...i tried with the different input and it worked. Also there was issue with the file permissions after fixing this two issues, logstash is working fine now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2020, 10:39am UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617/7 "2020-10-06T10:39:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.