Hello,
I might be able to help. Need to ask a couple question that may pertain to web loading problems.
- How much logs are you ingesting per hour/day?
- What does you index setting look like? or do you have multiply index sets beside the default ones?
- What are you log retention settings?
- Do you have a lot of extractors configured? if so what type and how many do you have?
- How’s your JAVA heap setting for Graylog?
Judging from your Environmental information, If you have a lot of logs being ingested you know elasticsearch is resource intensive. That why most community member separate ES from Graylog/MongoDb in a situation like that. I have seen in some situation where they have over sharded there server causing a lag and unresponsive interface. You can find out why here