I have today a graylog installation on tests in my structure.
And only one of our servers is generating around 9GB of daily logs.
Reading some documents about Graylog, I noticed that ElasticSearch is the element that uses the most disk.
I create a custom index mapping ( http://docs.graylog.org/en/2.1/pages/configuration/elasticsearch.html#custom-index-mappings ) removing the analysis of the full_message, but i have one question.
How to minimize the disk usage on Graylog ? The index mapping is a solution ?
Anyone have tips ?