-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
default bulk sizes #628
default bulk sizes #628
Conversation
Doesn't this potentially cause memory issues for Packetbeat? It can be 1000 * 2048 transactions stored in memory, right? |
We already have some memory issues in topbeat and packetbeat. I have another PR in the pipeline to address this issue. |
Ok, then we just need to make sure both changes are merged in all the same branches. If the other change is small, might then make sense to put it in this PR? |
Should we also update the doc to show the new default in the example here? https://www.elastic.co/guide/en/beats/filebeat/1.0.1/filebeat-configuration-details.html#_spool_size |
@dedemorton good point. thanks |
b1fa7ba
to
12e0e36
Compare
see PR #649 for limiting total number of buffered events |
LGTM |
- set default spooler size in filebeat to 2048, in order to increase number of lines to be combined into one bulk request - set default bulk max size to 2048, to guarantee not to split bigger bulk requests into too many small requests. Tested different spooler and bulk sizes using NASA-HTTP logs: spooler bulk | cpu(%) mem-res(MB) throughput(1k lines/s) --------------------------------------------------------------------- 1024 200 | 26 20 2.1 1024 1024 | 55 20 15.7 2048 2048 | 66 25 18.2 3072 3072 | 66 28 18.5 4096 4096 | 70 33 18.7
- add changelog entries about spool_size and bulk_max_size defaults
0b61e39
to
cb6eea1
Compare
related to #587
lines to be combined into one bulk request
requests into too many small requests.
Tested different spooler and bulk sizes using NASA-HTTP logs: