Found the solution to our problem with Filebeat

[ContriaConnect]

Since I can’t reply to my previous topic.
We found the cause for our problem in this topic:

Filebeat spams our Graylog server

1. Describe your incident: We have various servers which create multi line PHP stack traces. To collect these we use Filebeat. We have a working config (see below) but it works only on one server as soon as we apply it to a second server, it starts to send huge amounts of logs. We already use a similar config successfully on all our PHP servers, only the part with “drupal” is new. Interestingly we don’t see the logs on the server, just in the license overview we see a huge spike and Graylog…

The problem was that the VMs had a “large” backlog of logs. Around 2-4 GB each. Filebeat then parsed the logs and send them uncompressed to Graylog.
We now cleaned the journal down to 500MB each.
Filebeat still sent the logs but after a few minutes Graylog ingested them all and the load went down to normal levels.