Hello, We've an Input configured for our Network logs (Average of 500messages/sec, and kept for about 6months). We have 2 elasticsearch servers, and 4 shards.
Everything is running quite smoothly, except when we want to Edit an extractor. The moment we click on it, the load average of ES servers is growing, 60/70% of IOWait on ES disks, and it takes about 1minut to get the Edit of an extractor available. Our ES disks are located on a SAN, and we cannot really do a lot more … and we don't understand why editing an extractor loads ES that much . Anybody can give some information/help about what we can do? Thanks in advance for your help. Regards; -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/b5138f45-df93-483b-b00b-403c1a1ed093%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
