hi,everyone. i am using graylog-open version to receive syslogs(mostly device is network,such as fortigate firewall 、radius server logs).and i am facing a problem: when fortigate log transfer to graylog server,the process and output buffer is coming 100% immediately. soon the alert is coming as “Gr…

Hello, If so could show the compose.yaml file it might help? Normally when th e buffers are getting full it could mean a couple things. 1.bad regex,grok pattern, or piepline 2.Not enough resources for your buffers. this would be in you graylog.conf file. you can use "locate graylog.config" …

thanks for your replying! there is my current docker-compose.yaml.i have changed “ES_JAVA_OPTS=-Xms512m -Xmx512m” to “ES_JAVA_OPTS=-Xms2048m -Xmx2048m”, and it seems not work. Process and output buffer is stll high. so cloud you please give me other sugguestion? version: ‘3’ services: mongo: im…

thanks for your replying! there is my current docker-compose.yaml.i have changed “ES_JAVA_OPTS=-Xms512m -Xmx512m” to “ES_JAVA_OPTS=-Xms2048m -Xmx2048m”, and it seems not work. Process and output buffer is stll high. so cloud you please give me other sugguestion? version: '3' services: mongo: …

How are you parsing the incoming logs? Extractors? Pipeline? Can you show an example message and exactly how you are parsing it?

Hello @masterdou The following I found some odd and/or missed settings. Not sure if they were suppose to be there or were forgotten. links: - mongodb:mongo - elasticsearch - GRAYLOG_HTTP_BIND_ADDRESS=0.0.0.0:9000 ### This setting is kind of high unless you have that amount of memo…

there is only 8 extractors for each input. and it use similar Regular expression like this: [image] as for pipeline,there is not configured

thanks for your replying @gsmith ! in my compose yaml, three containers are using same network named graylog which type is bridge,so i don’t think the link configuration is necessary. links: - mongodb:mongo - elasticsearch as for other configuration,i have changed to your advise,but unfortunatel…

65536 messages in process buffer, 100% utilized

Graylog Central (peer support)

masterdou (Masterdou) September 13, 2022, 1:32am 10

there is only 8 extractors for each input. and it use similar Regular expression like this:

as for pipeline,there is not configured

Topic		Replies	Views
Journal utilization is too high - process buffer 100% Graylog Central (peer support) alert , elastic	20	6371	April 11, 2022
Graylog high journal utilization is too high Graylog Central (peer support)	43	13148	January 25, 2022
Graylog Cluster, Buffer process 100% stop process messages Graylog Central (peer support)	22	17183	November 28, 2018
Struggling with Graylog stopping to export to Elasticsearch Graylog Central (peer support) pipeline-rules , debuggingpl	14	2120	August 5, 2021
Graylog output will stop Graylog Central (peer support)	10	500	September 14, 2023

65536 messages in process buffer, 100% utilized

Related topics