What kind of size is better to set logstash pipline?

Elastic Stack Logstash
1

I have 3 logstash servers with 16GB memory and 4vcpu enabled in a cluster environment.
so my question is that what kind of size is better to set logstash pipline ?

My configure file like this as below:

OS:

mem:16G
cpu:4

Java heap size:

-Xms8g
-Xmx8g

logstash pipline:

# This defaults to the number of the host's CPU cores.
pipeline.workers: 4
 
# How many workers should be used per output plugin instance
pipeline.output.workers: 4
 
# How many events to retrieve from inputs before sending to filters+workers
pipeline.batch.size: 5000

Problem:

[2017-07-31T11:59:45,748][WARN ][logstash.pipeline ] CAUTION: Recommended inflight events max exceeded! Logstash will run with up to 20000 events in memory in your current configuration. If your message sizes are large this may cause instability with the default heap size. Please consider setting a non-standard heap size, changing the batch size (currently 5000), or changing the number of pipeline workers (currently 4)

Ａny ideas of what kind of size is better to set logstash pipline ?
by the way, what's max pipline size of single instance logstash even if with a big memory or multiple core cpus?

Thanks in adavance

2

Any update on this?

3

First of all, this warning is just this. A warning that the total inflight events would be more than 10k (although depending on the message size it may run out of heap). Logstash should start fine with 5k batch sizes even it seems overkill to me.

Why did you opt for such a large batch size? Bigger does not necessarily equal better. The answer to your question is "test performance".
You should monitor your CPU utilization and I/O wait as well as Logstash throughput, first starting with the default batch size, and then slowly increment it until you hit a maximum throughtput while minimizing I/O wait. There is not magic formula that works across all use cases.

4

hi @paz
Thanks for you suggestions, i'll enable jvm monitoring on logstash server.
i'll also jvm performance besides cpu and io etc..

Thanks

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.