# Logstash network output blocking - 7.3.0

**URL:** <https://discuss.elastic.co/t/logstash-network-output-blocking-7-3-0/195037>\
**Category:** Logstash\
**Created:** [August 13, 2019, 1:44pm UTC](https://discuss.elastic.co/t/logstash-network-output-blocking-7-3-0/195037 "2019-08-13T13:44:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![espenk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/espenk/32/52199_2.png) [@espenk](https://discuss.elastic.co/u/espenk)\
**Post date:** [August 13, 2019, 1:44pm UTC](https://discuss.elastic.co/t/logstash-network-output-blocking-7-3-0/195037/1 "2019-08-13T13:44:11Z")

</div>

Hi. I'm currently having issues with a Logstash instance not being utilized properly. Maximum load is ~ 50% on a 18 core VM running CentOS 7.6.1810. If I replace tcp output{} with file output{} , the load increase to ~90%. (and EPS has a 2x increase)

I have yet to identify the root cause, and not found any evidence pointing towards a unreliable link/host. Destination is able to receive ~800 Mbit/s if i manually netcat data from Logstash host to same destination port, when Logstash in avg transmits 100 Mbit/s. No packets are dropped according to ping, and latency is fine. The destination host is a CentOS 7.6.1810 VM, that receive logs through rsyslog. (imptcp).

Logstash configuration is: (multiple pipelines)  
file input pipeline -\> filter pipeline -\> tcp output pipeline  
tcp output pipeline has 6 workers, but only 1-3 are in a running state at any time. the remaining threads are in a interruptable sleeping state (shown as 'S' in htop).

Logstash version: 7.3.0

Trace logs do not reveal any errors.  
Moreover, I am not able to identify any TCP resets after analyzing the traffic in Wireshark.

Could anyone please provide suggestions to what I can debug further?

---

<div class="post-metadata">

**Author:** ![espenk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/espenk/32/52199_2.png) [@espenk](https://discuss.elastic.co/u/espenk)\
**Post date:** [August 13, 2019, 1:51pm UTC](https://discuss.elastic.co/t/logstash-network-output-blocking-7-3-0/195037/2 "2019-08-13T13:51:17Z")

</div>

I'll also add that it seems that this blocking have gotten worse after i upgraded to 7.3.0. Earlier, I've managed to reach 70% load on 6.8.2.

---

<div class="post-metadata">

**Author:** ![espenk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/espenk/32/52199_2.png) [@espenk](https://discuss.elastic.co/u/espenk)\
**Post date:** [August 14, 2019, 7:11am UTC](https://discuss.elastic.co/t/logstash-network-output-blocking-7-3-0/195037/3 "2019-08-14T07:11:25Z")

</div>

Further testing, shows that same issue is apparent on UDP transfers aswell.

---

<div class="post-metadata">

**Author:** ![espenk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/espenk/32/52199_2.png) [@espenk](https://discuss.elastic.co/u/espenk)\
**Post date:** [August 14, 2019, 2:14pm UTC](https://discuss.elastic.co/t/logstash-network-output-blocking-7-3-0/195037/4 "2019-08-14T14:14:58Z")

</div>

Problem caused by overloaded tcp/udp worker. Despite setting up multiple pipeline.workers they still share a single CPU thread responsible for network transmission. Fix was to setup multiple outputs similar to how inputs can be multithreaded.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2019, 2:15pm UTC](https://discuss.elastic.co/t/logstash-network-output-blocking-7-3-0/195037/5 "2019-09-11T14:15:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.