Indices.fielddata.cache.size


(Tom) #1

Graylog Version 2.2.1

Where exactly should we specify this attribute (20% seems to be the consensus).
My ES cluster gave up this morning, after a month of operation;

[WARN ][indices.breaker.fielddata] [fielddata] New used memory 20949355340 [19.5gb] for data of [message] would be larger than configured breaker: 19903571558 [18.5gb], breaking

I’ve specified it in elasticsearch.yml, which didn’t seem to work. I’ve now specified it in graylog’s server.conf < is that correct?

Is there anything in _nodes/stats that will tell me if I’ve set it correctly?

Thanks,
Tom


(Jochen) #2

The Elasticsearch configuration file is the correct place to put this setting. Did you modify the correct file and did you restart Elasticsearch after changing it?

See https://www.elastic.co/guide/en/elasticsearch/guide/current/_limiting_memory_usage.html for details.

No, that’s the wrong configuration file.

You can check the settings via the Elasticsearch Settings API: https://www.elastic.co/guide/en/elasticsearch/reference/2.4/cluster-update-settings.html


(Tom) #3

Looks like it’s actually related to an old issue (I’ve found on the old Graylog group), relating to using the ‘message’ field to generate ‘Quick Statistics’.

This can be closed. I will ensure my users are not using this field in future.

Thank you :slight_smile:
Tom