Hello and thank you @gsmith
Regarding the mismatched IP-addresses I think that the http_bind_address in graylog config was changed when I was troubleshooting something during deployment. Back then I found some post here with someone that had the same problem as i back then was facing (don’t really remember what it was), and I simply followed the steps in that post. Because, if not apparent… I really have no idea what I’m doing here and it’s all learning by doing, breaking, googling, and breaking some more.
I will look at changing back http_bind_address and network.host to 127.0.0.1 and see what happens. But since it works now I’m not sure I should poke around too much.
THe issue with the java process, the filled process buffer seems to be related to one of my inputs for our VMWare hosts. I have imported a dashboard and some extractors for it and those Grok patterns seems to more or less kill the server. I read here on the forum that grok patterns can do that. For now I have disabled that input and I’ll have to investigate that further. With that input disabled the buffers are more or less empty.
thanks again for the help! Much appreciated!