Split Filter is not multi thread, how to fix this?

[rkhapre]

i am using a conf file whole input flush 80K records after read

input {
  http_poller{
      urls => {
         http_request => {
				method => get
				url => "http://xyzfmt=CSV"
				}
			}

			codec => "json"  
		  }
} 
filter {  
			
			
split {
	field => "message"
	}
    csv {
        columns => ["Org", "Network", ......................................"Brand"]
        separator => ","
    }


mutate {
    remove_field => ["message","tags"]
  }
			 
}


output { 
stdout { codec => rubydebug } 
elasticsearch 
{ 

}
}

After reading the input i get 80 K records and it does split operations and i have to wait 4 hrs

Why i cant i do filter operations on 20 records --> output to 20 records
then in second batch
filter operations on another 20 records --> output another 20 records to output

Currently it does split operation 80 K records which takes around 4 hrs and then start posting records to output, which is very slow process.

For this i have to wait 4 hrs to see records in output, cant we start seeing it just after minutes at least records in batches of 20?

Cant we start seeing 20 records in output in couple of minutes, else i have to wait 4 hrs to check the output

I have tried keeping the pipeline worker more that 2, 4,6, 12 but nothing works out. Looks like its a bug on split filter

pipeline.workers: 2
pipeline.output.workers: 2

[colinsurprenant]

Hello @rkhapre, thanks for your report.

The split filter should not have any multi threading issue so I doubt that it is causing any particular delays in your pipeline.

I would suggest trying to find what is causing the delay with the following strategy:

• It is unlikely you need to specify pipeline.output.workers: 2, there is already one output per worker, so your setting would effectively put 2 output workers per worker which mean a total of 4 output workers.
• first remove the elasticsearch output and only use stdout+rubydebug to see what kind of throughput you get.
• if it did not change then I would suggest trying to replace the http_poller input with a simple stdin input and use a local data sample and feed it to logstash through STDIN using cat for example and see what you get.

Unless we have more information that would indicate there is a specific issue with the split filter could you please use the logstash discuss forum for such usage questions?

Thanks.