# Logstash use 100% CPU in lazy mode **URL:** \ **Category:** Logstash\ **Created:** [September 12, 2018, 12:10pm UTC](https://discuss.elastic.co/t/logstash-use-100-cpu-in-lazy-mode/148314 "2018-09-12T12:10:46Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![max583](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max583/32/33765_2.png) [@max583](https://discuss.elastic.co/u/max583)\ **Post date:** [September 12, 2018, 12:10pm UTC](https://discuss.elastic.co/t/logstash-use-100-cpu-in-lazy-mode/148314/1 "2018-09-12T12:10:46Z")
Good day! I have Logstash 6.2 with ES 6.2. Logstash use 100% of one core in lazy mode without any load. Is it normal? ![pic3](https://us1.discourse-cdn.com/elastic/original/3X/a/d/ad5755e3da7370f99edcb4897592795e79b6d8ad.jpeg) [elog@srv7-owltank current]$ ps aux | grep logstash elog 21660 110 3.4 5867628 1118488 pts/3 Sl 15:00 10:56 /usr/java/jdk1.8.0\_181-amd64/bin/java -Xss2048k -Xmx2g -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=9123 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.local.only=true -Djava.io.tmpdir=/data/elog/logstash/current -cp /data/elog/logstash/current/logstash-core/lib/jars/animal-sniffer-annotations-1.14.jar:/data/elog/logstash/current/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/data/elog/logstash/current/logstash-core/lib/jars/error\_prone\_annotations-2.0.18.jar:/data/elog/logstash/current/logstash-core/lib/jars/google-java-format-1.5.jar:/data/elog/logstash/current/logstash-core/lib/jars/guava-22.0.jar:/data/elog/logstash/current/logstash-core/lib/jars/j2objc-annotations-1.1.jar:/data/elog logstash/current/logstash-core/lib/jars/jackson-annotations-2.9.1.jar:/data/elog/logstash/current/logstash-core/lib/jars/jackson-core-2.9.1.jar:/data/elog/logstash/current/logstash-core/lib/jars/jackson-databind-2.9.1.jar:/data/elog/logstash/current/logstash-core/lib/jars/jackson-dataformat-cbor-2.9.1.jar:/data/elog/logstash/current/logstash-core/lib/jars/janino-3.0.8.jar:/data/elog/logstash/current/logstash-core/lib/jars/javac-shaded-9-dev-r4023-3.jar:/data/elog logstash/current/logstash-core/lib/jars/jruby-complete-9.1.13.0.jar:/data/elog/logstash/current/logstash-core/lib/jars/jsr305-1.3.9.jar:/data/elog/logstash/current/logstash-core/lib/jars/log4j-api-2.9.1.jar:/data/elog/logstash/current/logstash-core/lib/jars/log4j-core-2.9.1.jar:/data/elog/logstash/current/logstash-core/lib/jars/log4j-slf4j-impl-2.9.1.jar:/data/elog/logstash/current/logstash-core/lib/jars/logstash-core.jar:/data/elog/logstash/current/logstash-core/lib/jars/slf4j-api-1.7.25.jar org.logstash.Logstash -l /data/logs/elog/logstash --path.settings /data/elog/logstash/current/config --path.config /data/elog logstash/current/config/conf.d --http.host 0.0.0.0 --http.port 9600 ![pic1](https://us1.discourse-cdn.com/elastic/original/3X/8/5/85c6d4e9df4e8d302b9dbabaed6873a926771f86.jpeg) ![pic2](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b1ad287808a3d3a3f884c7ad664ff6b1f05f479.jpeg) Thank you!!! ---
**Author:** ![max583](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max583/32/33765_2.png) [@max583](https://discuss.elastic.co/u/max583)\ **Post date:** [September 12, 2018, 12:16pm UTC](https://discuss.elastic.co/t/logstash-use-100-cpu-in-lazy-mode/148314/2 "2018-09-12T12:16:24Z")
Logstash config: input { beats { host =\> "0.0.0.0" port =\> 5044 tags =\> ["filebeat"] } http { host =\> "0.0.0.0" port =\> 31311 } .. } filter { if "jsonl" in [type] or ([fields] and [fields][document\_type] == "jsonl") { .... } else { grok { patterns\_dir =\> ["/data/elog/logstash/current/config/patterns"] match =\> { "message" =\> "%{LOG\_CODE:log\_code} %{DATESTAMP:date\_time} - \<%{SESSION\_ID:session\_id}\>,%{BASE10NUM:call\_time},%{SERVICE\_CODE},%{BASE10NUM: add\_tag =\> ["brt\_reject"] } date { match =\> ["date\_time", "dd/MM/yy HH:mm:ss"] } if [message] =~ /^(I:[A-Z]{3}|[F,D,S,P]:[A-Z]{2,3})/ { # Alternative: [log\_code] ~= ^I:CC drop {} } } mutate{ add\_field =\> { "logstash" =\> "$(HOSTNAME)"} } } output { if ![fields]{ elasticsearch { document\_type =\> "filebeat" hosts =\> ["srv7-lipoglav:9200"] index =\> "logstash-main-filebeat-elog-%{+YYYY.MM.dd}" } } else { elasticsearch { document\_type =\> "filebeat" hosts =\> ["srv7-lipoglav:9200"] index =\> "logstash-main-%{[fields][index\_prefix]}-elog-%{+YYYY.MM.dd}" } } } ---
**Author:** ![max583](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max583/32/33765_2.png) [@max583](https://discuss.elastic.co/u/max583)\ **Post date:** [September 25, 2018, 2:53pm UTC](https://discuss.elastic.co/t/logstash-use-100-cpu-in-lazy-mode/148314/3 "2018-09-25T14:53:16Z")
Solution: [Logstash 6.2.2 high CPU usage](https://discuss.elastic.co/t/logstash-6-2-2-high-cpu-usage/122672) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 23, 2018, 2:53pm UTC](https://discuss.elastic.co/t/logstash-use-100-cpu-in-lazy-mode/148314/4 "2018-10-23T14:53:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.