I am using the Ubuntu image, we created a hosted VM based on the appliance with what I think are the same specs the VM had, dual core CPU, 4Gb of RAM. It has been working great but I get the feeling I have abused it and performance has taken a nosedive.
I have been testing the parsing of logs, I have filebeat feeding logs from a folder on my laptop, my process has been to create extractors, feed in some logs (typically up to 6 10mb log files), review the data then delete the index and repeat, adding extractors etc. as I go.
I am up to index graylog_16 so it’s fair to say I have been through that many iterations, now however the server is slammed, NMON shows one java process using 198% CPU. I have tried restarting graylog (graylog-ctl restart) and rebooting the server but it makes no difference.
I am not concerned about performance overall right now but I would like to know if there’s a way to “reset” things, I’m no expert but I’m guessing it is the journal that is overwhelmed? Without rebuilding the server is there a way to reset everything back, ideally without losing my configuration setup?
Thank,
Chris.