Interesting problem you have there!
Am I right in understanding that you are running Graylog + MongoDB + ElasticSearch together on that one host? Technically speaking it shouldn’t be much of a problem, though it’s suboptimal. Best do some maths on your Java heap sizes.
What are your Java heaps for Graylog and Elastic configured for right now?
Based on your current 32 GB of RAM I would suggest:
- 1 or 2 GB for Graylog heap, no more as @jan has suggested before).
- 10 GB for Elastic, assuming that caching etc will eat up another 10GB.
See also this excellent post by Jan, explaining some more about the math:
You say that you’re restarting the Graylog server service(s). But have you also restarted Elastic and Mongo? These are separate process stacks.