Hi dear community!
I’ve been installing graylog system on our production environnement recently but I met a problem that I met on the development plateform.
Actually, I’m gathering log using rsyslog and collector-sidecar from 2 differents subnets for exemple : 184.108.40.206/24 and 192.168.0.0/24. My graylog server is set only on the 220.127.116.11 subnet.
I got only 1 node of Graylog server 2.2 and 1 node elasticsearch 2.4.4. They are installed on 2 differents VM with centos 7.1 minimal. Firwalld and Selinux are disabled.
To gather log from both subnet I need to set up the gateway on the graylog server but when I set it up, the GUI get very very slow, almost unusable. Also, (in the graylog GUI) the heap space bar monitoring of the elasticsearch node doesn’t show up anymore and I got a message saying the API isn’t usable.
Nevertheless, the job is partially done. Message from both subnet are stored in the elasticsearch base.
Maybe something wrong on the graylog network configuration that may work on one plateform but the other?
Any clue that could help me with my investigation?
Thanks in advance!