Graylog Output issue to Elasticsearch

[tmacgbay]

There was further research in the post I put out recently that helped show which messages were locking up the process buffers. It was definitely a GROK-lock scenario for me… It shows in the post where to look for locked process buffers.

Graylog nodes stop outputting/fill up buffers

Hi, we have a curios little problem in which one graylog node out of a 3 + 2 Cluster stops outputting messages. filling up the buffers and subsequently the journal. This happens about every other day and can be resolved by a “graceful shutdown” and restart of the node in question. Unfortunately there is nothing in the logs from graylog or elasticsearch that would indicate a problem. Is there additional logging we could enable to get behind this issue or look at other places besides the standa…