I have installed graylog server, mongodb, and Elasticsearch master in 3 servers, and 4 of them have installed Elasticsearch Slave.
If I want increase the search speed , what can I do?
increase graylog server or increase Elasticsearch Master / Slave
Hello && Welcome @isgood
I would ensure you have fast drive like a SSD and a lot of CPU & Memory, perhaps 30% more then you really need for the setup would be a good start.
And take a look here…
When first starting out you may have to make adjustments to configuration settings and resources. This will depend on the environment that Graylog is in.
Quick sketch, how I do tune Elastic:
- 50% of RAM for the java-heap, rest for filesystemcaches via OS
- bundeling streams with the same fielsnames on the same index-set. (e.g. all winlogbeat on one)
- set the index set for daily rotation
- for each 20-30GB of data on a stream one shard on the index set
- for each 20 shards one GB of heap on the machines.
1 Like
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.