Please review this for more information on heap sizes.
We have configured elasticsearch to use 50% of ram, graylog-server to use 33%, and left the remaining roughly 17% available for the operating system/other services. So far that configuration has been ok for us.
So your elasticsearch heap size is too small most likely. If the system has 12 GB RAM available I would set -Xms6g and -Xmx6g. If it’s 16 GB, I would do -Xms8g and -Xmx8g. Once you make the change, restart the elasticsearch service.
It would be nice to confirm this is the issue by reviewing the elasticsearch service log for symptoms of memory exhaustion.
thank you very much for your support and your information, it’s very kind of you, so i have to change the value , what exactly is the value I need to change ??
You’re welcome of course.
Change -Xms1g to -Xms6g or -Xms8g. Change -Xmx1g to -Xmx6g or -Xmx8g. Then restart the elasticsearch service:
systemctl daemon-reload
systemctl restart elasticsearch
Review the document I linked above for more information on jvm heap sizes. My recommended configuration is not necessarily optimal for your needs, and this isn’t necessarily the solution.
done , I changne 2 value of -Xms1g to -Xms6g and the -Xms1g to -Xms6g 
now it is it seems OK but
In search , when I look for "the last 5 or 15 minutes, no logs appear but appear only for the 30 minutes or last hour or more
Now , it works @cawfehman Now it is good Thanks a lot
@Labidi, can you please clarify what you changed? You repeated that you changes -Xms1g. Did you also change -Xmx1g?
It’s catching up… give it some time… you can see the oldest message in the journal. Hopefully that fixes your issue moving forward.
Good luck
