Graylog Version 2.2.1
Where exactly should we specify this attribute (20% seems to be the consensus).
My ES cluster gave up this morning, after a month of operation;
[WARN ][indices.breaker.fielddata] [fielddata] New used memory 20949355340 [19.5gb] for data of [message] would be larger than configured breaker: 19903571558 [18.5gb], breaking
I’ve specified it in elasticsearch.yml, which didn’t seem to work. I’ve now specified it in graylog’s server.conf < is that correct?
Is there anything in _nodes/stats that will tell me if I’ve set it correctly?
The Elasticsearch configuration file is the correct place to put this setting. Did you modify the correct file and did you restart Elasticsearch after changing it?
See Limiting Memory Usage | Elasticsearch: The Definitive Guide [2.x] | Elastic for details.
No, that’s the wrong configuration file.
You can check the settings via the Elasticsearch Settings API: Cluster Update Settings | Elasticsearch Guide [2.4] | Elastic
Looks like it’s actually related to an old issue (I’ve found on the old Graylog group), relating to using the ‘message’ field to generate ‘Quick Statistics’.
This can be closed. I will ensure my users are not using this field in future.