Sometimes seems the logs are changed somewhere and grok freezing ang logstash uses 100% CPU permanently and does not filtering logs.
After restart logstash is trying to parse the records in persistent queue but in some time is in freeze again.
It will be good to have some like an utility to view the records in persistent queue file to get the record which is freezing logstash.
also found the issue:
for example we have 100 records in persistent queue. It parsed the 60 records until it is trying to parse "wrong" record and start freezing. We restart logstash and have again 100 records in queue to parse.
ELK 5.6.2