I feel that my graylog-server node data processing is not balanced, and I don’t know what the problem is. My cluster has 7 nodes, but one node’s Process buffer is often full, while other nodes have basically no backlog.
Is this normal?
Is this normal?
You want to make some dashboards that to see if certain sources are coming through that one node or something. The field gl2_source_node contains the node that the message was delivered through, so you can use that to break the messages out in the dashboard.
Thank you for your answer.This field gl2_source_node dashboard.It seems that the node number 4cca717d has a larger amount of data than other nodes. It is also this node that often backlogs data.What’s the issue?
By the way, my input configuration does not select a single node and applies globally.
If you use that gield as a group by and then also group by a source, or maybe input, are you able to narrow down if that node is getting more traffic in general, or is it getting more traffic of one specific type. The idea here is to figure out what data is maybe not being properly load balanced, or even a source that is pointed directly at that machine and bypassing the load balancer all together.
My input consumes data from kafka. Does it have anything to do with my input configuration? My input config like this pic.
It shouldnt be an issue. Its a global input and its set to throttle, which should be what you need. How much processing are you doing to the messages?
How much processing? What’s the mean? config file options?
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.