Logstash on docker, performance with IRC->Slack

[Jackson_Pollock]

Hello,

I am running your docker image:

version: '2'
services:
logstash:
image: docker.elastic.co/logstash/logstash:5.6.2
volumes:
- ./pipeline:/usr/share/logstash/pipeline
- ./config/logstash.yml:/usr/share/logstash/config/logstash.yml
ports:
- "5001:5001"
environment:
LS_JAVA_OPTS: "-Xmx256m -Xms256m"

and I have several inputs running without issue: imap, twitter etc.

however, with this IRC connection to Slack, it is runs the CPU up to 100% and stays there, config below:

input {
irc {
host => "xxx.irc.slack.com"
#IRC channels
channels => [ "#xxx1", "#xxx2" ]
user => "slackuser"
nick => "slackuser"
password => "xxxxxxsecretxxxxxxx"
real => "Slack Integration"
secure => true
tags => ["slack"]
#type is useful for searching later
type => "seslack"
}
}

It does function and sends the data to elastic. There is very little activity in slack so it's not traffic related.

I also noticed that it ignores the slack channels specified above and pulls in every channel that this user has access to.

Any ideas appreciated, maybe there's a timer someplace to slow down it's polling rate or something...

thanks!

[Jackson_Pollock]

No one has a clue?

there is nothing in the logs and it continues to function, just runs the CPU up.

[Jackson_Pollock]

ahemm.. well it works the same way sans docker. Running on a native install on ubuntu 16.04 it does the same thing.