Generally you want the total number of active threads to be equal to the number of CPUs. This avoids context switching, which is expensive.
If you have a single pipeline on a server dedicated to logstash then the default of having the number of worker threads equal to the number of CPUs makes perfect sense.
If you have a server that runs multiple apps then decide how many of the CPUs you want logstash to use, and then allocate them among the pipelines that you have. It is OK to have slightly more worker threads than CPUs, but not significantly more.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.