# Logstash slow input for TCP CEF Codec

**URL:** <https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808>\
**Category:** Logstash\
**Created:** [September 17, 2019, 10:45am UTC](https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808 "2019-09-17T10:45:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moses\_Lim\_Him\_Kuong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moses_lim_him_kuong/32/45055_2.png) [@Moses\_Lim\_Him\_Kuong](https://discuss.elastic.co/u/Moses_Lim_Him_Kuong)\
**Post date:** [September 17, 2019, 10:45am UTC](https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808/1 "2019-09-17T10:45:30Z")

</div>

I'm setting up an instance of logstash that will be receiving CEF events from tcp port. I'm expecting it to be able to get up to 10k EPS but its only getting to around 2k on the input.

What should i do?

i'm on a 8core 16gb VM, logstash running on docker with 4gb heap set to it

---

<div class="post-metadata">

**Author:** ![franco.federico](https://avatars.discourse-cdn.com/v4/letter/f/67e7ee/32.png) [@franco.federico](https://discuss.elastic.co/u/franco.federico)\
**Post date:** [September 17, 2019, 12:40pm UTC](https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808/2 "2019-09-17T12:40:26Z")

</div>

Hi  
Could you share your logstash.conf file?

Bye  
Franco

---

<div class="post-metadata">

**Author:** ![Moses\_Lim\_Him\_Kuong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moses_lim_him_kuong/32/45055_2.png) [@Moses\_Lim\_Him\_Kuong](https://discuss.elastic.co/u/Moses_Lim_Him_Kuong)\
**Post date:** [September 17, 2019, 2:20pm UTC](https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808/3 "2019-09-17T14:20:36Z")

</div>

There is sensitive information on the filter and output so the most i can share the input

input{  
tcp{  
port =\> 5144  
codec =\> cef . {  
delimiter =\> "\r\n"  
raw\_data\_field =\> raw\_data\_field  
}  
}  
}

I notice the Input EPS is pretty low, When i'm using flume i can easily get up to 10k.

---

<div class="post-metadata">

**Author:** ![Moses\_Lim\_Him\_Kuong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moses_lim_him_kuong/32/45055_2.png) [@Moses\_Lim\_Him\_Kuong](https://discuss.elastic.co/u/Moses_Lim_Him_Kuong)\
**Post date:** [September 19, 2019, 2:35am UTC](https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808/4 "2019-09-19T02:35:05Z")

</div>

I noticed that without the cef parser i can go up to 15k eps.

Wondering anything i can tune on the cef or ruby side?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 17, 2019, 2:35am UTC](https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808/5 "2019-10-17T02:35:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.