# Logstash Slow after small config change

**URL:** <https://discuss.elastic.co/t/logstash-slow-after-small-config-change/85174>\
**Category:** Logstash\
**Created:** [May 10, 2017, 12:52am UTC](https://discuss.elastic.co/t/logstash-slow-after-small-config-change/85174 "2017-05-10T00:52:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Allie\_Yang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allie_yang/32/16538_2.png) [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)\
**Post date:** [May 10, 2017, 12:52am UTC](https://discuss.elastic.co/t/logstash-slow-after-small-config-change/85174/1 "2017-05-10T00:52:03Z")

</div>

Hi I have changed only one place in my log config file, by adding one field into the prune's whitelist.  
Then, the logstash parses super slowly, 10X roughly. Also, the added variable does not show properly in Kibana: **no cached mapping for this field.**

My question is if I change the config file like this, is this the normal reaction? If so, should I rename it to a new index pattern?

PS: i also tried put mapping for this new field, but it doesn't allow me, Error is exceed 1000 field limit for each index.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 14, 2017, 9:07am UTC](https://discuss.elastic.co/t/logstash-slow-after-small-config-change/85174/2 "2017-05-14T09:07:34Z")

</div>

Please show us the config file and the change you made as that may make it easier to help. It does however sound like the issue is with the large number of fields in your mapping and that you bare hitting the limit Elasticsearch imposes in order to prevent [mapping explosion](https://www.elastic.co/blog/found-crash-elasticsearch#mapping-explosion). If you have a lot of different types of data in the same index, it may make sense to split them up into a few indices and thereby reduce the number of fields per index. If you have some type of data that dynamically creates field names you should look into addressing that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 11, 2017, 9:08am UTC](https://discuss.elastic.co/t/logstash-slow-after-small-config-change/85174/3 "2017-06-11T09:08:26Z")

</div>

Closed on June 11, 2017, 9:08am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.