i’m trying to tune my graylog configuration and i’m playing with processbuffer_processors / outputbuffer_processors / inputbuffer_processors.
But there is some rules regarding the number of vCPU ram etc…?
My setup is composed of one graylog (~1500msg/sec) and one cluster of 3 elsatic search .
ES vm is 4vCPU (not really loaded) 16GB with HEAP at 12GB
Graylog is 2vCPU (30/40% loaded) 8GB with HEAP at 4GB.
The rule of thumb would be that those three settings processbuffer_processors / outputbuffer_processors / inputbuffer_processors should be equal to the number of CPUs you have.
I have a VM running Elastic and GL with 2 CPU’s and 2 cores each. From what I can tell the “default” totals 12 processors. What is your recommendation? We only collect from about a dozen syslog senders.