I did not find the answer in other topics, so I created my own.

Server:

• Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-182-generic x86_64)
• AMD EPYC 7601 32-Core Processor
• 16GB RAM

Builded elk stack from docker compose and get a high cpu usage n my server. Can not find the reason

Docker compose

version: '3.8'

services:
  es01:
    image: es:${SERVICE_NAME}
    container_name: es01
    restart: unless-stopped
    build:
      context: .
      dockerfile: ./elk-config/elasticsearch/Dockerfile
      args:
        ELK_VERSION: ${ELK_VERSION:-7.13.3}
    networks:
      - ${NETWORK_NAME}
    volumes:
      - "${HOST_PATH}/elk/elasticsearch/es01/data:/usr/share/elasticsearch/data:rw"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    environment:
      - cluster.name=es-docker-cluster
      - network.host=0.0.0.0
      - node.name=es01
      - discovery.seed_hosts=es02
      - cluster.initial_master_nodes=es01,es02
      - "ES_JAVA_OPTS=-Xms2048m -Xmx2048m"
      - bootstrap.memory_lock=true
      - xpack.license.self_generated.type=basic
      - xpack.security.enabled=true
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.client_authentication=required
      - xpack.security.transport.ssl.keystore.path=elastic-certificates.p12
      - xpack.security.transport.ssl.truststore.path=elastic-certificates.p12
  es02:
    image: es:${SERVICE_NAME}
    container_name: es02
    restart: unless-stopped
    build:
      context: .
      dockerfile: ./elk-config/elasticsearch/Dockerfile
      args:
        ELK_VERSION: ${ELK_VERSION:-7.13.3}
    networks:
      - ${NETWORK_NAME}
    volumes:
      - "${HOST_PATH}/elk/elasticsearch/es02/data:/usr/share/elasticsearch/data:rw"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    environment:
      - cluster.name=es-docker-cluster
      - network.host=0.0.0.0
      - node.name=es02
      - discovery.seed_hosts=es02
      - cluster.initial_master_nodes=es01,es02
      - "ES_JAVA_OPTS=-Xms2048m -Xmx2048m"
      - bootstrap.memory_lock=true
      - xpack.license.self_generated.type=basic
      - xpack.security.enabled=true
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.client_authentication=required
      - xpack.security.transport.ssl.keystore.path=elastic-certificates.p12
      - xpack.security.transport.ssl.truststore.path=elastic-certificates.p12
  logstash:
    image: logstash:7.13.3
    container_name: logstash
    restart: unless-stopped
    networks:
      - ${NETWORK_NAME}
    volumes:
      - "./elk-config/logstash/:/usr/share/logstash/pipeline"
    environment:
      - SERVICE_NAME=${SERVICE_NAME}
      - NODE_ENV=${NODE_ENV}
      - LOGSTASH_ELASTICSEARCH_USERNAME=${LOGSTASH_ELASTICSEARCH_USERNAME}
      - LOGSTASH_ELASTICSEARCH_PASSWORD=${LOGSTASH_ELASTICSEARCH_PASSWORD}
      - LOGSTASH_PORT=${LOGSTASH_PORT}
    depends_on:
      - es01
      - es02
  kibana:
    image: kibana:${SERVICE_NAME}
    build:
      context: ./elk-config/kibana/
      args:
        ELK_VERSION: ${ELK_VERSION:-7.13.3}
    container_name: kibana
    restart: unless-stopped
    networks:
      - ${NETWORK_NAME}
    volumes:
      - ./elk-config/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml
      - ./elk-config/certs:/etc/kibana/config/certs
    environment:
      - ELASTICSEARCH_USERNAME=${KIBANA_ELASTICSEARCH_USERNAME}
      - ELASTICSEARCH_PASSWORD=${KIBANA_ELASTICSEARCH_PASSWORD}
    depends_on:
      - es01
      - es02
      - logstash

kibana.yml

server:
  name: "elk"
  host: "0.0.0.0"
  port: 5601
elasticsearch.hosts: ["http://es01:9200","http://es02:9200"]
monitoring.ui.container.elasticsearch.enabled: true
csp.strict: true

logstash conf

input {
  tcp {
      port => "${LOGSTASH_PORT}"
  }
}

filter {
  json {
    source => "message"
  }
}

output {
    elasticsearch {
        index => "logs-${NODE_ENV}"
        hosts => ["http://es01:9200","http://es02:9200"]
        user => "${LOGSTASH_ELASTICSEARCH_USERNAME}"
        password => "${LOGSTASH_ELASTICSEARCH_PASSWORD}"
    }
}

htop metrics

How to find the reason of that CPU consumption?