Tuning up filebeat


(Sumit Sontakke) #1

Filebeat is sending logs to logstash-> elasticsearch. Increasing number of workers shows slight increase in events rate in monitoring at kibana.

Max how much I can increase number of workers. I read somewhere optimum number of workers is 3 to 5. Is it true?

  hosts: ["loadbalancers-endpoint"]
  ttl: 3s
  worker: 5
  loadbalance: true
  pipelining: 0


(Steffen Siering) #2

Filebeat can be quite fast. When tuning it's a matter of tuning all services, Beats, Logstash, and Elasticsearch. Tuning needs can very much differ from environment to environment.

I'd recommend to read this discussion, as it contains a many tips and good practices applied.