# Logstash thread using high CPU usage **URL:** \ **Category:** Logstash\ **Created:** [February 18, 2022, 7:01pm UTC](https://discuss.elastic.co/t/logstash-thread-using-high-cpu-usage/297634 "2022-02-18T19:01:03Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jestin.varghese](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jestin.varghese](https://discuss.elastic.co/u/jestin.varghese)\ **Post date:** [February 18, 2022, 7:01pm UTC](https://discuss.elastic.co/t/logstash-thread-using-high-cpu-usage/297634/1 "2022-02-18T19:01:03Z")
Hi, Following threads in our logstash is using high CPU usage # ====================== bash-4.2$ curl -XGET 'localhost:9600/\_node/hot\_threads?human=true' ::: {} Hot threads at 2022-02-18T19:50:45+01:00, busiestThreads=10: 90.56 % of cpu usage, state: runnable, thread name: '[main]\>worker7', thread id: 42 app//org.joni.ByteCodeMachine.execute(ByteCodeMachine.java:185) app//org.joni.ByteCodeMachine.matchAt(ByteCodeMachine.java:167) app//org.joni.Matcher.matchCheck(Matcher.java:287) app//org.joni.Matcher.searchCommon(Matcher.java:460) app//org.joni.Matcher.search(Matcher.java:301) app//org.jruby.RubyRegexp.matcherSearch(RubyRegexp.java:231) app//org.jruby.RubyRegexp.search(RubyRegexp.java:1331) app//org.jruby.RubyRegexp.matchPos(RubyRegexp.java:1220) app//org.jruby.RubyRegexp.matchCommon(RubyRegexp.java:1188) * * * 90.4 % of cpu usage, state: runnable, thread name: '[main]\>worker3', thread id: 38 app//org.jcodings.Encoding.isMbcWord(Encoding.java:487) app//org.joni.ByteCodeMachine.opWordBound(ByteCodeMachine.java:1132) app//org.joni.ByteCodeMachine.execute(ByteCodeMachine.java:218) app//org.joni.ByteCodeMachine.matchAt(ByteCodeMachine.java:167) app//org.joni.Matcher.matchCheck(Matcher.java:287) app//org.joni.Matcher.searchCommon(Matcher.java:460) app//org.joni.Matcher.search(Matcher.java:301) app//org.jruby.RubyRegexp.matcherSearch(RubyRegexp.java:231) app//org.jruby.RubyRegexp.search(RubyRegexp.java:1331) app//org.jruby.RubyRegexp.matchPos(RubyRegexp.java:1220) app//org.jruby.RubyRegexp.matchCommon(RubyRegexp.java:1188) app//org.jruby.RubyRegexp.match\_m(RubyRegexp.java:1154) app//org.jruby.RubyRegexp$INVOKER$i$match\_m.call(RubyRegexp$INVOKER$i$match\_m.gen) app//org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:417) app//org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:172) * * * ## 90.37 % of cpu usage, state: runnable, thread name: '[main]\>worker6', thread id: 41 app//org.joni.ByteCodeMachine.execute(ByteCodeMachine.java:185) app//org.joni.ByteCodeMachine.matchAt(ByteCodeMachine.java:167) app//org.joni.Matcher.matchCheck(Matcher.java:287) app//org.joni.Matcher.searchCommon(Matcher.java:460) app//org.joni.Matcher.search(Matcher.java:301) app//org.jruby.RubyRegexp.matcherSearch(RubyRegexp.java:231) app//org.jruby.RubyRegexp.search(RubyRegexp.java:1331) app//org.jruby.RubyRegexp.matchPos(RubyRegexp.java:1220) app//org.jruby.RubyRegexp.matchCommon(RubyRegexp.java:1188) app//org.jruby.RubyRegexp.match\_m(RubyRegexp.java:1154) app//org.jruby.RubyRegexp$INVOKER$i$match\_m.call(RubyRegexp$INVOKER$i$match\_m.gen) app//org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:417) app//org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:172) # 90.31 % of cpu usage, state: runnable, thread name: '[main]\>worker0', thread id: 35 app//org.joni.ByteCodeMachine.execute(ByteCodeMachine.java:185) app//org.joni.ByteCodeMachine.matchAt(ByteCodeMachine.java:167) app//org.joni.Matcher.matchCheck(Matcher.java:287) app//org.joni.Matcher.searchCommon(Matcher.java:460) app//org.joni.Matcher.search(Matcher.java:301) app//org.jruby.RubyRegexp.matcherSearch(RubyRegexp.java:231) app//org.jruby.RubyRegexp.search(RubyRegexp.java:1331) app//org.jruby.RubyRegexp.matchPos(RubyRegexp.java:1220) app//org.jruby.RubyRegexp.matchCommon(RubyRegexp.java:1188) app//org.jruby.RubyRegexp.match\_m(RubyRegexp.java:1154) app//org.jruby.RubyRegexp$INVOKER$i$match\_m.call(RubyRegexp$INVOKER$i$match\_m.gen) app//org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:417) app//org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:172) usr.share.logstash.vendor.bundle.jruby.$2\_dot\_5\_dot\_0.gems.jls\_minus\_grok\_minus\_0\_dot\_11\_dot\_5.lib.grok\_minus\_pure.invokeOther1:match(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:182) usr.share.logstash.vendor.bundle.jruby.$2\_dot\_5\_dot\_0.gems.jls\_minus\_grok\_minus\_0\_dot\_11\_dot\_5.lib.grok\_minus\_pure.RUBY$method$execute$0(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:182) Does anyone has any idea regarding this threads. Please help us here. Thanks in advance. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 18, 2022, 8:32pm UTC](https://discuss.elastic.co/t/logstash-thread-using-high-cpu-usage/297634/2 "2022-02-18T20:32:33Z")
You have some very expensive grok patterns there. There is advice about anchoring and using tiered patterns to improve performance [here](https://www.elastic.co/blog/do-you-grok-grok). If you want more specific advice then post your grok configuration (including any custom patterns) and an example of your data. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 18, 2022, 8:33pm UTC](https://discuss.elastic.co/t/logstash-thread-using-high-cpu-usage/297634/3 "2022-03-18T20:33:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.