Logstash slow input for TCP CEF Codec

[Moses_Lim_Him_Kuong]

I'm setting up an instance of logstash that will be receiving CEF events from tcp port. I'm expecting it to be able to get up to 10k EPS but its only getting to around 2k on the input.

What should i do?

i'm on a 8core 16gb VM, logstash running on docker with 4gb heap set to it

[franco.federico]

Hi
Could you share your logstash.conf file?

Bye
Franco

[Moses_Lim_Him_Kuong]

There is sensitive information on the filter and output so the most i can share the input

input{
tcp{
port => 5144
codec => cef . {
delimiter => "\r\n"
raw_data_field => raw_data_field
}
}
}

I notice the Input EPS is pretty low, When i'm using flume i can easily get up to 10k.

[Moses_Lim_Him_Kuong]

I noticed that without the cef parser i can go up to 15k eps.

Wondering anything i can tune on the cef or ruby side?