I am trying configure Graylog so that I am to search for messages and find out what sizes they are in ElasticSearch after a sudden recent up in disk consumption in the cluster. I have the Mapper Size plugin installed on all the ES nodes and configured the custom index template to enable _size field …

Have you tried to show all fileds in graylog? But I’m not sure, it will show the _size field. You can also check the search in elasticsearch via elasticsearch API. It will show the field. Or you can try elasticdump to dump the full database.

Yup, I tried that in Graylog already. I tried searching with ES API, which showed results but none of the fields returned on the results it supposedly found included _size. Not entirely sure if it’s working at all.

Mapper Size in Graylog

Graylog Central (peer support)

macko003 October 24, 2018, 9:50am 4

unfortunately I can’t suggest more.
https://community.graylog.org/t/adding–size-field/1353/2

Topic		Replies	Views
Get log message size Graylog Central (peer support)	5	4984	February 15, 2018
Adding _size field Graylog Central (peer support)	2	1325	June 12, 2017
Maxmium message size in graylog Graylog Central (peer support)	5	12067	December 19, 2017
Graylog outgoing traffic size and indice sizes different Graylog Central (peer support)	3	2170	January 26, 2020
Aggregate on message size across multiple events Graylog Central (peer support)	5	1523	July 17, 2018

Mapper Size in Graylog

Related topics