I use a graylog 3-node cluster for my log processing. There are about 500k messages/day getting in.
After switching from logstash to filebeat as log processor, I saw that only one of my nodes is properly processing the messages. The other ones are only enabled, when the master node is completely used by a certain amount of messages. (figured that out after re-enabling big hosts).
I already checked the input, it’s global and other settings do not look very suspicious to me. Do you have any ideas how to fix this?