Error Data too large

Graylog Central (peer support)
1

getting this error,

my memory and drive utilization low, can you please help

  • Search type returned error: [parent] Data too large, data for [<agg [375bcdc0-0fcc-44df-bc84-d0291f65f9aa-series-count(request)]>] would be [726700056/693mb], which is larger than the limit of [726571417/692.9mb], usages [request=36224/35.3kb, fielddata=145806/142.3kb, in_flight_requests=15150/14.7kb, accounting=726502876/692.8mb][parent] Data too large, data for [<agg [375bcdc0-0fcc-44df-bc84-d0291f65f9aa-series-count(request)]>] would be [726746455/693mb], which is larger than the limit of [726571417/692.9mb], usages [request=31040/30.3kb, fielddata=197389/192.7kb, in_flight_requests=15150/14.7kb, accounting=726502876/692.8mb][parent] Data too large, data for [<agg [375bcdc0-0fcc-44df-bc84-d0291f65f9aa-series-count(request)]>] would be [726781137/693.1mb], which is larger than the limit of [726571417/692.9mb], usages [request=15488/15.1kb, fielddata=242503/236.8kb, in_flight_requests=15150/14.7kb, accounting=726502876/692.8mb].
2

@inet45 You can check your JVM setting for the Graylog and ES, which might be low, or your Journal utilization is too high. Please verify that your Elasticsearch cluster is healthy and fast enough. You may also want to review your Graylog journal settings and set a higher limit.

I hope this helps you!

3

@makarands thanks, can you point on which file to modify and what settings to modify, i am very new to using the graylog and ES

4

Good morning, hope all is well.

/etc/graylog/server/server.conf is the main config file

And if you go to System/Nodes… Nodes you can see the JVM usage

And here’s a video on Java Heap size

Hope it helps. Thank you, Zach.

5

awesome, very helpful this resolved the issue
Thank You