I have a Graylog Cluster with 2 GL Servers and 3 Elasticsearch Servers.
I have the Problem that sometimes Graylog just stops indexing new messages into Elasticsearch although ES is online.
To fix it I usually have to restart the Elasticsearch Processes.
Sometimes it works fine for a week or two and sometimes it only works for 3 days. Reproducing this doesn’t seem possible.
Where should I look at to see what the source of this is?