Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describe your incident: After upgrading from Graylog 5.x to 6.1.5, there has been a de…

@NicoS thank you for your reply. Are you currently running the system after downgrading to version 6.0?

Yes, after realizing the performance drop, I had to go back to 6.0.7 (or now 6.0.8 in fact). On my side the drop was significant (more than yours), we could not output as much data as we got in… (to be honest, we are working kind of on the limit anyway…) Yesterday I upgraded my machines to more CP…

We are in a situation where it is difficult to downgrade, so we are continuously testing to improve output performance. The currently identified issue is that there is a significant difference in the load on OpenSearch between directly querying OpenSearch and searching via the Graylog dashboard. Q…

Hey @yokim , that is surprising to hear. Do you also see the long runtime of the search when you are starting a search and removing the message count widget, just keeping the message table? Do you gather metrics for your OpenSearch cluster that could help us understand what is happening there?

Hi @yokim , did you observe notable differences in the metrics of your Elasticsearch cluster after the Graylog upgrade, and could you share those? Also, are you running any additional outputs? Regarding your configuration, I’m curious as to why you’ve set output_batch_size = 100 which is very low. …

[image] yokim: elasticsearch oss 7.10.2 Hi @yokim , I noticed that you reported this ES version above, but wrote that you are using OpenSearch (and OpenSearch Dashboards) in a later comment. Please let us know which search backend you are using. If you are using OpenSearch, the exact version…

@yokim Another question: Did you notice anything suspicious in your Graylog server logs regarding the output path, like more indexing errors or retries?

Graylog 6.1.5 performance

Graylog Central (peer support)

NicoS (Nico S) January 16, 2025, 10:53am 2

I experienced similar problems with upgrading from 6.0.7 to 6.1.x

Tried to discuss it there:
https://community.graylog.org/t/after-upgrade-from-6-0-7-to-6-1-performance-degrade/33908/16

However, there was no solution…

Topic		Replies	Views
The output speed to ElasticSearch is very slow Graylog Central (peer support)	3	2050	January 16, 2020
After Upgrade from 6.0.7 to 6.1 performance degrade? Graylog Central (peer support)	21	759	March 10, 2025
Issues with Graylog after moving to an elasticsearch cluster Graylog Central (peer support)	21	2692	June 24, 2018
How can we improve output message rate to elasticsearch Graylog Central (peer support)	2	3904	May 27, 2019
Very high outputbuffer_processors count and small output_batch_size for better message throughput? Graylog Central (peer support)	5	8074	January 1, 2018

Graylog 6.1.5 performance

Related topics