Hi, I would like to know where graylog stores the logs if the elasticsearch has fallen. Today there was a situation that elasticsearch fell, but after its restoration logs began to arrive, which were written at that time while elasticsearch was unavailable.
the messages are stored in the Graylog journal if Elasticsearch is not available as long as the configured limits are not reached you will not loose any messages.
Should you reach the limitations you have configured it will act like a FIFO Pipe - the first messages ingested will be dropped to free space for the new incoming.
Thanks, for the answer.
where is i can change size of journal graylog? What setting in server.conf is responsible for this?
And where is the data written? in RAM or on disk? And which section if the disk? And where i can reade documentation about journal?
I think I found the answer to my question. He writes to disk, is it true? to the folder / var / lib / graylog-server / journal But what parameter in the configuration is responsible for setting the amount of logs that need to be stored?
please try to answer your questions by reading the comments in the server.conf and/or the documentation
http://docs.graylog.org/en/3.0/pages/configuration/server.conf.html
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.