In my Graylog server I have on Graylog server and two elasticsearch servers. I have configured elasticsearch as a cluster. The necessary configuration added to graylog server.conf as well.
But according to my observation once I keep the cluster, message are getting queued and after queued got 100% messages are getting dropped.
However once I removed one elasticsearch and keep it separate and run Graylog server with single elasticsearch server, messages are process perfectly. no pending messages.
Why I am getting these kind of issue. Are there any configuration mismatch or missing error ?
Can Any once faced issue like this ?