What is the better way to take full advantage of Logstash (MEM and CPU)?

Elastic Stack Logstash
1

Hi,
I'm running Logstash 2.2.2 in Ubuntu as a service (sudo service logstash start) and I want to have as much speed (in shipping) as possible. Is it better to run several instances in the same box or using as much memory and RAM as possible in one instance? I'm trying to do the latest... so..
There is /etc/init.d/logstash. In there, is an option: LS_HEAP_SIZE="1g". If I want to make it faster, should I put a bigger number there? My server has 64G in RAM, so I put LS_HEAP_SIZE="31g", but the server is using only a little of the RAM.
Bottom line... what is the best way to make Logstash run as fast as possible?

PS: I also wanted to try the "-w" flag. Is that a good option? Where should I to put it in the /etc/init.d/logstash file? In the "args" section?

2

In there, is an option: LS_HEAP_SIZE="1g". If I want to make it faster, should I put a bigger number there

No, not unless Logstash is running out of heap (which it probably isn't).

PS: I also wanted to try the "-w" flag. Is that a good option? Where should I to put it in the /etc/init.d/logstash file? In the "args" section?

No, don't touch the init script. Put it in LS_OPTS in /etc/default/logstash. Logstash 2.2.2 has a pretty reasonable default value though.

But don't make random configuration changes. Where's your performance bottleneck? CPU, disk, something else? What do your inputs look like?

3

I still have RAM, CPU and disk IO available, so I just wanted to use more resources.