Hi. Trying to collect logs and analyze with graylog. using the system CentOS Linux 7 (Core) Graylog MongoDB Elastic Search Java С помощью winlogbeat # Needed for Graylog fields_under_root: true fields.collector_node_id: ${sidecar.nodeName} fields.gl2_source_collector: ${sidecar.nodeId} o…

Hello && Welcome @Alex25 You will have to wait till Elasticsearch gets done, noticed this. [image] Depending on your resource this may take some time. Also when Output Buffer are over 90% chance ar this may be a configuration error in Graylog config file or you don’t have enough resource to han…

Ok, well I would stop ingestion logs till the Output buffer clears, Deleting Journal is not good. Graylog Configuration file /etc/graylog/server.conf These are the ones you need to know about if they look like this… processbuffer_processors = 5 outputbuffer_processors = 3 inputbuffer_processor…

Thanks, I’m checking now. Grok, I’m not at a meeting, I think everything is there by default …

Some advice , when you see the Output buffer fill like that , chances are something is with Elasticsearch.

I tried to expand the collection of logs in the previous settings, when setting up elasticsearch, I configured the minimum indexes accordingly. rotate_strategy = number elasticsearch_max_docs_per_index = 20000000 elasticsearch_max_number_of_indices = 20 elasticsearch_shards = 1 elasticsearch_re…

Oh boy, I would keep those as they were, If you need to correct you index I would do that through the Web UI. [image] Alex25: configured the minimum indexes accordingly. rotate_strategy = number elasticsearch_max_docs_per_index = 20000000 elasticsearch_max_number_of_indices = 20 elasticsea…

Not sure, must be a lack of comminution. [image] Alex25: What do you mean wrong with him? [image] gsmith: ome advice , when you see the Output buffer fill like that , chances are something is with Elasticsearch [image] gsmith: Elasticsearch

[image] gsmith: processbuffer_processors = 5 outputbuffer_processors = 3 inputbuffer_processors = 2 [image] Alex25: rotate_strategy = number elasticsearch_max_docs_per_index = 20000000 elasticsearch_max_number_of_indices = 20 elasticsearch_shards = 1 elasticsearch_replicas = 0 chec…

Awesome, :+1: Yeah I think the main issue is that your Output buffers are filled, when that go back down to 0% you should see something.

Graylog nx log help

Graylog Central (peer support)

Alex25 August 10, 2022, 3:53am 3

Ok
system characteristics
4CPU
16Gb Memory
50 Gb hdd
100 second HDD

What parameters need to be increased to use more resources for processing?

Topic		Replies	Views
Setup of Graylog and NXLog Graylog Central (peer support) nxlog	13	4786	January 13, 2023
Collecting Windows Logs with nxlog doesn´t work properly Graylog Central (peer support) nxlog	3	274	July 18, 2024
nxLog , Messages not showing Graylog Central (peer support) sidecar , nxlog , nodatanx	8	4097	March 8, 2018
Not seeing any messages from IIS (nxlog) Graylog Central (peer support) nxlog	7	1069	August 31, 2022
Issues creating a buffer for with nxlog Graylog Central (peer support) nxlog	8	161	March 26, 2025

Graylog nx log help

Related topics