you can change 'message' mapping template in ES via it's rest api, and add `"doc_values": true` to some less needed fields, more info or doc values here: https://www.elastic.co/guide/en/elasticsearch/reference/current/doc-values.html
W dniu czwartek, 21 kwietnia 2016 00:48:57 UTC+2 użytkownik Jason Haar napisał: > > Hi there > > I tried to do what I thought was a simple search across a week's worth of > data on a single-box graylog server (ie it also has ES and mongodb on it) > > Basically I did a search for "fieldname:value1 OR fieldname:value2 OR > fieldname:value3" over 7days and graylog just sat there spinning it's > wheels (before hand I was happily doing searches that weren't causing any > grief at all) > > The CPU on the graylog server went through the roof, graylog error file > showed no problem, but ES logs showed a bunch of these > > indices.breaker.fielddata] [fielddata] New used memory 11155918063 > [10.3gb] for data of [message] would be larger than configured breaker: > 10857952051 [10.1gb], breaking > > After five minutes of graylog just sitting there, I restarted ES, but > graylog was now borked. The input channels were still receiving data, but > nothing was flowing out. So I restarted graylog and all was good again > > Is this expected behaviour, and if so, what is needed to stop it? I've > seen other non-graylog related postings on the ES list about this happening > with large clusters, so it seems to be an error case for ES, but I'm more > concerned over how graylog reacted: ie why didn't it give up and give me an > error page for starters. It looks to me like graylog didn't expect that ES > search to error out and that caused it to block? (I'm assuming ES generated > an error - the logs shows that WARN - I dunno what happens next) > > > -- > Cheers > > Jason Haar > Information Security Manager, Trimble Navigation Ltd. > Phone: +1 408 481 8171 > PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/56da2ae1-ed27-410d-b1dd-3a86e5716972%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
