# Rightsizing elastic batch size and number of workers **URL:** \ **Category:** Logstash\ **Created:** [November 22, 2021, 12:02pm UTC](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803 "2021-11-22T12:02:05Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![alaine](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@alaine](https://discuss.elastic.co/u/alaine)\ **Post date:** [November 22, 2021, 12:02pm UTC](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803/1 "2021-11-22T12:02:05Z")
I am trying to right size my configs for the logstashes that I have feeding my elastic stack. They are pushing filebeat and winlogbeat data. Right now they seem to be fairly underutilized and I am seeing a little bit of ingest lag within the stack. Right now my servers have 8 cpus and 15gb of memory. We have configured logstash to use 6 workers, a pipeline.batch.size of 1000 and a pipeline.batch.delay of 150. I have been reading through the documentation and haven't been able to come up with a decent formula for right sizing the situation. I don't have a problem playing with the numbers, but figured I would ask here in case someone has some valuable advice. Thanks ---
**Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\ **Post date:** [November 22, 2021, 2:19pm UTC](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803/2 "2021-11-22T14:19:22Z")
In the event that your data sent by the beats (filebeat, metricbeat, etc.) passes through logstash, be sure to assign the value of the log date to @timestamp. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 23, 2021, 12:29am UTC](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803/3 "2021-11-23T00:29:04Z")
I don't know what that comment has to do with the question @ahmed_charafouddine? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 23, 2021, 12:32am UTC](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803/4 "2021-11-23T00:32:10Z")
There is no formula because it's a bit of a complex question. The rough figure is to aim for is ~5MB of data, or \<5000 documents/events in each bulk request. ---
**Author:** ![alaine](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@alaine](https://discuss.elastic.co/u/alaine)\ **Post date:** [November 23, 2021, 9:33am UTC](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803/5 "2021-11-23T09:33:47Z")
@ahmed_charafouddine thanks for the answer, but I am confused. @warkolm so I am seeing rougly 3200events/sec on the logstash that I have been talking about. So it would seem like I would just set pipeline.batch.size to 3500? Though I have access to 6 cpus. So should that batch size be smaller like 500 if I make pipeline workers 6? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 21, 2021, 9:34am UTC](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803/6 "2021-12-21T09:34:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.