# Performance problem on a single cluster node

**URL:** <https://discuss.elastic.co/t/performance-problem-on-a-single-cluster-node/114042>\
**Category:** Elasticsearch\
**Created:** [January 4, 2018, 8:51am UTC](https://discuss.elastic.co/t/performance-problem-on-a-single-cluster-node/114042 "2018-01-04T08:51:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jayjay](https://avatars.discourse-cdn.com/v4/letter/j/35a633/32.png) [@jayjay](https://discuss.elastic.co/u/jayjay)\
**Post date:** [January 4, 2018, 8:51am UTC](https://discuss.elastic.co/t/performance-problem-on-a-single-cluster-node/114042/1 "2018-01-04T08:51:08Z")

</div>

Hi all,

I m curently upgrading our elasticsearch single node from 1.4.2 to 6.1. The new version is installed on a new server but the new logstash receive the same data (mainly logs). I have a really strange behavior, The new server write continuously 100-150 M/s (info from iotop) and the old one only a few M/s. I have the same behavior when I do a request, the new server read about 100-150 M/s and the old one only a few M/s.

I have no idea how to analyze this. Any help welcome.

Regards

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 4, 2018, 9:19am UTC](https://discuss.elastic.co/t/performance-problem-on-a-single-cluster-node/114042/2 "2018-01-04T09:19:57Z")

</div>

There are more data structures in recent versions of elasticsearch than in very old ones. Like doc values. That might explain.

You need to compare both mappings by the way to check how much they differ.

---

<div class="post-metadata">

**Author:** ![jayjay](https://avatars.discourse-cdn.com/v4/letter/j/35a633/32.png) [@jayjay](https://discuss.elastic.co/u/jayjay)\
**Post date:** [January 4, 2018, 11:53am UTC](https://discuss.elastic.co/t/performance-problem-on-a-single-cluster-node/114042/3 "2018-01-04T11:53:53Z")

</div>

Hi,

Thanks for you reply, it is almost the same logstash config except the syntax that I had to modify. for example:  
old:  
pattern =\> ["%{CISCO}", "%{CISCO2}"]  
new:  
match =\> { "message" =\> ["%{CISCO}", "%{CISCO2}"] }

So the mapping is almost the same.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2018, 11:54am UTC](https://discuss.elastic.co/t/performance-problem-on-a-single-cluster-node/114042/4 "2018-02-01T11:54:19Z")

</div>

Closed on February 1, 2018, 11:54am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.