Hi there I've got ongoing issues with graylog stopping working and it doesn't look like it's elasticsearch related
Right now graylog-web is reporting the following error: Some messages were deleted from the Graylog journal before they could be written to Elasticsearch. Please verify that your Elasticsearch cluster is healthy and fast enough According to "http://127.0.0.1:9200/_cluster/health";, elasticsearch is "green" with no unassigned shards/etc. I acknowledge I'm running an underspec'ed environment (waiting on hardware), but I'm trying to understand the failure modes here, so can someone confirm my logic?. graylog-server is writing to elasticsearch, ES is happy and reports no errors, but I guess it's taking too long to do individual transactions, and so graylog-server has to queue them up in the journal until it can. And if the journal fills up, then it triggers the above error? So we might be able to increase the journal size, but if the average throughput "load" of graylog-server is such that this is always happening, then you have to have a "faster" ES? Could it be that graylog-server itself is overloaded? ie that ES is fine - but I need more graylog-servers feeding into the same ES? How can I differentiate between those two - what does that error case look like? Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CAFChrgKRhcVKn44ELZYT-uUC%2Br5PMecf3eVtn-tdMfmEs2GnTA%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
