Could there be a throttling issue? I’m experimenting with activating DEBUG level logs for the problem node. And in an effort to clear the backlog, I am restarting the Graylog server and disabling all inputs, causing it to speed up its data processing by several orders of magnitude. It manages to process around 70,000 messages until it stops. I’m at 463,959 messages right now, let’s see how many restarts I’ll need to get it to zero.