I set up a Graylog instance and everythings it’s working smoothly.
After start receiveign a couple of logs I notice that the default JVM Heap size it’s a bit short (1 GB) and I read a little in google to increase it. The prefered way to do it it’s seems to be adding the tag “ES_HEAP_SIZE=xxg” in /etc/default/elasticsearch, but after doing this and reboot elasticsearch I noticed that in Graylog web platform the node it’s still showing a max size of 972.8MB.
Now, if I modified the settings in /etc/default/graylog-server it works and I can see it in the Node section in the web platform.
So far so good, but I noticed that if I run the command “curl -sS -XGET “localhost:9200/_cat/nodes?h=heap*&v””, the result shows me two results like this:
heap.current heap.percent heap.max
429.7mb 44 972.8mb
353.5mb 2 11.9gb
The thing is I only have one node, I don’t know why it shows me two results and if this is a normal behavior.
So now I’m unsure if I have to change the settings in the elasticsearch file and increasing the heap size theree (even if it doesn’t show up in the Graylog Node) or change it in graylog-server.