Hi, messages ingested by Graylog are first persisted to a disk journal. From there the messages are being read, processed (extractors, sorting into streams etc.), written to the outputs (by default Elasticsearch, other outputs depending on the configuration), and finally removed from the disk journal.
On Saturday, 9 April 2016 22:36:38 UTC+2, Graylog-WAF wrote: > > I have used the OVA file in which there is only 4 Gb of RAM. > > Does this have effect on the capacity of storage? > It doesn't affect the storage capacity directly, but the maximum possible message fields being loaded into memory by Elasticsearch, e. g. for the quick values functionality or searches in general. Cheers, Jochen On Saturday, 9 April 2016 22:33:48 UTC+2, Graylog-WAF wrote: > > Hello everybody, > > We are implementing Graylog2 and which is integrated with WAF. > > It's receiving about 2 Millions events per day. > > I would like to know where logs are saved at the beginning (I mean are > they saved directly in disk or in DB and then in disk). > > Also, is it possible to know the exact percentage that's used until now. > > Thanks ! > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/b898d0a9-abce-4695-8e87-84c21a2d189f%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
