Tuning up filebeat

Elastic Stack Beats
1

Filebeat is sending logs to logstash-> elasticsearch. Increasing number of workers shows slight increase in events rate in monitoring at kibana.

Max how much I can increase number of workers. I read somewhere optimum number of workers is 3 to 5. Is it true?

  hosts: ["loadbalancers-endpoint"]
  ttl: 3s
  worker: 5
  loadbalance: true
  pipelining: 0
2

Filebeat can be quite fast. When tuning it's a matter of tuning all services, Beats, Logstash, and Elasticsearch. Tuning needs can very much differ from environment to environment.

I'd recommend to read this discussion, as it contains a many tips and good practices applied.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.