Graylog master is down because of heap reached 8GB , only data node is running with same heap size 8GB . Output buffer is reached 100% datanote processing 109 messages in past 5 minutes. I am using 1master and 2 datanode in my elastic setup .
. After few minutes master joined again. Below is my elastic config:
2 master nodes with 2GB memory, i core cpu, 2 data nodes with 4GB memory and 1 core CPU. Below is last 1 hr elasticsearch status.
You most probably need more resources for elasticsearch. I would give more memory to all elasticsearch nodes. You probably do not need separate data and master nodes, but give at least 8G or preferably 16G memory to ES. ES nodes typically consume much more memory than graylog nodes.
Check the Elasticsearch log files to see whether there are any warnings or errors.
the full outputbuffer indicates that elaticsearch is having issues accepting messages - but eigher elasticsearch logs and/or graylog server.log will give you some more info
