Indices.fielddata.cache.size

Graylog Central (peer support)
1

Graylog Version 2.2.1

Where exactly should we specify this attribute (20% seems to be the consensus).
My ES cluster gave up this morning, after a month of operation;

[WARN ][indices.breaker.fielddata] [fielddata] New used memory 20949355340 [19.5gb] for data of [message] would be larger than configured breaker: 19903571558 [18.5gb], breaking

I’ve specified it in elasticsearch.yml, which didn’t seem to work. I’ve now specified it in graylog’s server.conf < is that correct?

Is there anything in _nodes/stats that will tell me if I’ve set it correctly?

Thanks,
Tom

2

The Elasticsearch configuration file is the correct place to put this setting. Did you modify the correct file and did you restart Elasticsearch after changing it?

See Limiting Memory Usage | Elasticsearch: The Definitive Guide [2.x] | Elastic for details.

No, that’s the wrong configuration file.

You can check the settings via the Elasticsearch Settings API: Cluster Update Settings | Elasticsearch Guide [2.4] | Elastic

3

Looks like it’s actually related to an old issue (I’ve found on the old Graylog group), relating to using the ‘message’ field to generate ‘Quick Statistics’.

This can be closed. I will ensure my users are not using this field in future.

Thank you :slight_smile:
Tom