Why the toolbar shows node count * throughput compared to metrics gotten from metrics page or using REST API. So here the metric gotten from GUI or masternode is litte under 4000. (5 nodes, 5*4000=20000). Metric used: org.graylog2.throughput.input.1-sec-rate
When using curl to get the metrics, only MASTER node shows counts which could be the actual metrics, if asked from other nodes, results are 0 or very near of it.
The Graylog ask all node’s metric about every 2 secs.
You can check it with tcpdump. But it’s only a momentary value.
All nodes provide the throughput value. Are you sure your all node get the messages not only the first one?
Checked with tcpdump.
Something/one had changed in our F5, and all the messages were sent to just only one node. Thanks for pointing to that direction.
Still I wonder why it showed (and still shows) all counts exactly same/node in the nodes page AND just multiplied master nodes count when all messages were sent to it by the LB.
The diffence is now that the summarized value seems correct now in the “toolbar”.
Nice catch! That’s a good thing to discover early 
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
