Regarding tuning Graylog Cluster

Graylog Central (peer support)
, ,
4
  1. set up a Loadbalancer. Without you will be lost
  2. separate your Graylog from Elastic/Opensearch
  3. know how to configure heap for Graylog and Elastic/Opensearch. Graylog should have about 80% of available RAM, Elastic/Opensearch 50% (rest for Caching by OS).
  4. for 10-15k msg/sec I use 3 GL nodes with 16 Cores and 32GB ram. As it should scale linear you can do the math
  5. Depending on how long you want to keep your data you will need a lot of storage. Make sure to know how to handle shards and calculate the necessary heap.
  6. adjust the number of processors in the graylog config for processing. Here you will need a big increase. Also for input and output some slight increases might be necessary.
3 Likes