# Logstash JVM heap running out of space

**URL:** <https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565>\
**Category:** Logstash\
**Created:** [May 30, 2017, 12:32pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565 "2017-05-30T12:32:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discuss.elastic.co/u/Exocomp)\
**Post date:** [May 30, 2017, 12:32pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565/1 "2017-05-30T12:32:21Z")

</div>

Need some advice on how to resolve this issue. I setup an ELK box (1 box) that is working great, except every 4 days or so logstash runs out of JVM heap and then doesn't do much processing and I have to do a restart to fix it again.

See below screenshot of the JVM steadily increasing:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/0/90c579672ac78a4a65388f97d6ba7b48aec14ac0.jpg)

Any advice what I can do to resolve this problem, the ELK instance is setup with 4GB of RAM. I don't think it is a RAM capacity issue as it is fine initially and overtime fills up the heap.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [May 30, 2017, 2:10pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565/2 "2017-05-30T14:10:39Z")

</div>

What version of Logstash? What does your configuration look like? Heap exhaustion is frequently the result of certain plugins being used in a particular configuration.

---

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discuss.elastic.co/u/Exocomp)\
**Post date:** [May 30, 2017, 3:00pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565/3 "2017-05-30T15:00:25Z")

</div>

@theuntergeek

Version ---\> 5.3.1  
pipeline.workers ---\> 6  
pipeline.batch\_delay ---\> 5  
pipeline.batch\_size ---\> 125

It is a single box with 4GB of RAM and 2 Cores and it is processing events / sec on average:

Input ---\> 128  
Filtered ---\> 228  
Output ---\> 228

It consists of the following plugins:

input:

- beats
- jdbc
- http\_poller
- file

filter:

- clone
- ruby
- mutate
- json
- grok
- date
- useragent
- geoip

output:

- elasticsearch
- graphite
- statsd

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [May 30, 2017, 3:15pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565/4 "2017-05-30T15:15:43Z")

</div>

This is still rather incomplete without the actual configuration. My suspicions center on the `ruby` and `clone` filters, however. These can abuse memory.

---

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discuss.elastic.co/u/Exocomp)\
**Post date:** [May 30, 2017, 5:24pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565/5 "2017-05-30T17:24:46Z")

</div>

@theuntergeek

I'll do some testing around clone and ruby filters to see if I can find a correlation and post my results. Thanks for the info.

---

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discuss.elastic.co/u/Exocomp)\
**Post date:** [June 5, 2017, 2:12pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565/6 "2017-06-05T14:12:48Z")

</div>

@theuntergeek

Made some progress, well at least ruled out cloning as the problem. Enabled cloning but disabled some processing of the cloned events and it became stable testing for 4 days. See screenshot.

![](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b93db8663df0501e689954d0def47a72196d3fac.jpg)

So I must be doing something in the processing of the clones only using the ruby filters, I will focus there and follow up.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 3, 2017, 2:12pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-running-out-of-space/87565/7 "2017-07-03T14:12:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.