I have a logstash instance which is taking in quite a bit of traffic via the tcp input. Logstash is currently cpu-bound on this particular server, which I understand is not at all an unusual situation. By cpu-bound I mean that I have six CPUs on my server, 6 worker threads, and each worker thread is using 95-100% of CPU time (one worker thread per CPU). Memory utilization and I/O are on the low side.
I'd like to better understand what exactly is going on when CPU bound. I assume that, since the machine is running at capacity, some incoming events will either a) be cached somewhere or b) be refused/dropped. If they are cached, where is the cache? If they are dropped, can I detect this situation somehow (is anything logged, for example)? Or is it something else entirely?
Thanks for the info!