Graylog Outgoing traffic

Graylog Central (peer support)
1

Greetings Graylog community!

I’ve been trying to analyze traffic patters from our Graylog instance. By searching the community I confirmed that “Outgoing traffic” as shown on the “System / Overview” page is traffic going to ElasticSearch and that is what counts towards the license.

image
image.png1878×381 17.9 KB

However, I wanted to clear up couple more things.

Is outgoing data uncompressed in any way?
I know Elastic has lz4 enabled by default so I’m wondering if that is applied before the data leaves Graylog or after it reaches ES.

Also, does “Outgoing traffic” graph include all clustered Graylog servers ?

Thanks!

2

He Zarko,

the traffic is the bytes in all fields that are user-generated (internal fields are not counted) written to elasticsearch. No compression or anything else in that.

The traffic is for all Graylog servers in your cluster - if you have more question, please contact sales ( https://www.graylog.org/contact-sales )

3

Thank you Jan! I appreciate your help.