Process and output buffer is 100% utilized

[jochen]

@tjb6

For forward planning, I’m assuming a second graylog node would be more helpful than separating graylog from ES, is that correct?

No, running Graylog and Elasticsearch on separate machines is more important. Otherwise they’ll compete for the same resources (CPU, memory, I/O bandwidth and disk cache) which leads to cache thrashing.