Why does logstash consume CPU time in idle state?

Elastic Stack Logstash
1

I push data to Logstash through Filebeat plugin on hourly basis, nothing else is transferred. My understanding is that during these idle periods Logstash should not consume CPU time. But it does although it is only 1%. I suspected GC, but looks like it's not related. Is there any chance I can fix this? Or is this expected behavior? Thanks.

  PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND
  4760 ubuntu    20   0 2321164 200188  10200 R  1.0 19.7   7:08.73 [main]>worker0
   4767 ubuntu    20   0 2321164 200188  10200 S  0.3 19.7   0:00.77 Api Webserver
  4717 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.00 java
  4736 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:08.75 LogStash::Runne
  4737 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.00 java
  4738 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:02.00 java
  4739 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:08.06 java
  4740 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.03 java
  4741 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.02 java
  4742 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.00 java
  4743 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.00 java
  4744 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:26.05 java
  4745 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:05.38 java
  4746 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.00 java
  4747 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:14.86 java
  4753 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.00 java
  4754 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:05.30 LogStash::Runne
  4755 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:03.42 LogStash::Runne
  4756 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:03.79 LogStash::Runne
  4757 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:04.64 LogStash::Runne
  4758 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:03.35 [main]-pipeline
  4759 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:01.63 [main]-pipeline
  4761 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.80 [main]-pipeline
  4762 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.04 [main]<beats
  4763 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:13.18 [main]-pipeline
  4764 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:02.78 Api Webserver
  4765 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.92 Api Webserver
  4766 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:01.36 Api Webserver
  4768 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.00 Api Webserver
  4769 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:01.00 [main]<beats
  4770 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:08.65 LogStash::Runne
  4771 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:08.59 LogStash::Runne
  7694 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:01.21 [main]<beats
  7695 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.05 [main]<beats
  7696 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.00 [main]<beats
  8754 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.63 [main]<beats
  8755 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.03 [main]<beats
  9838 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.03 [main]<beats
  11016 ubuntu    20   0 2321164 200188  10200 S  0.0 19.7   0:00.03 [main]<beats
2

This is pretty much much normal and you should expect ~1% CPU usage even when it's "idling". It could be GC, it could logging, it could metrics gathering tasks in the background and it could be all these combined.

3

Thanks for quick response! 1% is not a big deal, just looking for ways how AWS CPU credits can be saved.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.