Metricbeat, Filebeat spawning lots of child procs

[perfecto25]

Hello, Im running fbeat, mbeat 7.17 on centos 7

I see it spawning off tons of child procs, is there way to limit this? Whats the reason why so many procs are spawned?

[mtojek (Marcin Tojek)]

Could you please share your config file? How do you start the application?

[perfecto25]

standard systemd start up script (comes w rpm install)

config

filebeat.inputs:
#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s


filebeat.modules:
- module: system
  enabled: True
- module: iptables
  enabled: True

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 1
  setup.template.enabled: true
  setup.template.overwrite: true

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  host: "https://xxxx.com:5601"
  username: "beats_setup"
  password: "xxxxx"
  ssl:
    certificate_authorities: "/etc/pki/elastic/ca.crt"
    verification_mode: "certificate"
  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.
  #space.id:
#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://xxxxx.com:9200"]

  # Optional protocol and basic auth credentials.
  protocol: "https"
  #api_key: "Zkl1MmdYMEJlUlR6VkVmb09YVmg6Rk9ITExlR1BTTVNXNjNQX3JuY2h0dw=="
  username: "beats_writer"
  password: "xxxxxx"
  ssl:
    certificate_authorities: ["/etc/pki/elastic/ca.crt"]
    verification_mode: "certificate"
#================================ Processors =====================================

# Configure processors to enhance or manipulate events generated by the beat.

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging.level: error

with pstree and htop, I do see tons of sleeping child procs

is there a reason so many child procs are being spawned and then remain in S state? Is it because of lingering tcp connections?