Increase the search speed

I have installed graylog server, mongodb, and Elasticsearch master in 3 servers, and 4 of them have installed Elasticsearch Slave.

If I want increase the search speed , what can I do?
increase graylog server or increase Elasticsearch Master / Slave

Hello && Welcome @isgood

I would ensure you have fast drive like a SSD and a lot of CPU & Memory, perhaps 30% more then you really need for the setup would be a good start.

And take a look here…

When first starting out you may have to make adjustments to configuration settings and resources. This will depend on the environment that Graylog is in.

Quick sketch, how I do tune Elastic:

  • 50% of RAM for the java-heap, rest for filesystemcaches via OS
  • bundeling streams with the same fielsnames on the same index-set. (e.g. all winlogbeat on one)
  • set the index set for daily rotation
  • for each 20-30GB of data on a stream one shard on the index set
  • for each 20 shards one GB of heap on the machines.
1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.