Greetings Graylog community!
I’ve been trying to analyze traffic patters from our Graylog instance. By searching the community I confirmed that “Outgoing traffic” as shown on the “System / Overview” page is traffic going to ElasticSearch and that is what counts towards the license.
However, I wanted to clear up couple more things.
Is outgoing data uncompressed in any way?
I know Elastic has lz4 enabled by default so I’m wondering if that is applied before the data leaves Graylog or after it reaches ES.
Also, does “Outgoing traffic” graph include all clustered Graylog servers ?