No Output to ElasticSearch

Hi @poisedforflight

This problem is related to your disk utilization in the Elasticsearch cluster.

Journal is a machanism in Graylog to temporally store you data when ES cannot for some reason.

In your case in particular, your ES Cluster isn’t receiving data to be indexed due to disk utilization.

If you have spare space in your filesystem you can change settings about the watermark in Elasticsearch.

Otherwise you should consider move those data to another node with more space.

Based on your Graylog version, I think you can work with Elasticsearch ILM to migrate data between nodes in order to avoid this problem.

P.S.: If you’re considering migrate Graylog to v4 ILM is not an option, and you shold take a look at this post to know how to proceed.