I Have had the same problem with not having all the indices. When I did a recalculate indexranges it crached on an javaoutofmemory error. It appeared that ES was using default memory ( 1G) instead of what I had configured.
configuring ES_HEAP_SIZE in elasticsearch.yml did not do anything (on cents-6.5), so I wrote the parameter directly into /etc/init.d/elasticsearch after then all was fine. On Thursday, September 11, 2014 11:26:39 AM UTC+2, Jerri Son wrote: > > Well, > > after 4 days graylog became unresponsive (again) and I had to delete the > one big indice and start from scratch again. > Although I really like graylogs frontend I might need to get > logstash/kibana up and running if we keep running > into page error 200 after a few days of collecting logs. > > Am Mittwoch, 3. September 2014 16:32:44 UTC+2 schrieb Jerri Son: >> >> Hi, >> I had some trouble with instances going missing and thus lacking logs >> from several days ago. >> As far as I could tell, the indices were: >> -physically there >> -not closed >> -API queryable >> -closable and reopenable >> >> Now, when I did query "IndexRanges" only 8 out of 11 Indices were >> "included" no matter how many times >> I rebuilt/synced the ranges. >> My setup was that I had max-docs set to 20m and number of indices to 50. >> I noticed, too, that when the number indices >> went > 8 older ones just fell out of ranges. Is there a hard coded limit >> for the amount of opened indices I failed to see? >> >> My solution for now was to create a rather huge index with 200m maxdocs >> and max number of indices of 4. >> >> I tried with 0.20.6 and the latest 0.21beta4. Any ideas? Or are bigger >> indices the way to go? >> >> Cheers! >> > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
