This reminded me of a similar issue I had a while back where I Graylog would lock up and I could see things listed in a process buffer dump (“I see dead things”) the post was here - hopefully that will have some info that will help (not with corrupt journal tho…) In short I believe it was a GROK where I had %{IP:iclient_ip} but some messages had 'localhost' so GROK choked… changing it to the more inclusive %{IPORHOST:client_ip} made all the difference.