Hello Frns
After going through logstash aggregation filter documentation,I understood that if the start event and end event is defined during aggregation then log stash will hold the details related to start event until end event arrival and then push it to output as end event after applying all logic. Since everything Is happening in memory till it writes to output ,Is there any performance impact?
Absolutely. With an aggregate filter you have to set "--pipeline.workers 1", so logstash cannot take advantage of multiple processors, and even desktops have multiple processors these days.
On servers that have dozens or even hundreds of CPU cores, being single threaded is a big performance hit.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.