Hello, We've an Input configured for our Network logs (Average of 500messages/sec, and kept for about 6months). We have 2 elasticsearch servers, and 4 shards.
Everything is running quite smoothly, except when we want to Edit an extractor. The moment we click on it, the load average of ES servers is growing, 60/70% of IOWait on ES disks, and it takes about 1minut to get the Edit of an extractor available. Our ES disks are located on a SAN, and we cannot really do a lot more … and we don't understand why editing an extractor loads ES that much . Anybody can give some information/help about what we can do? Thanks in advance for your help. Regards; -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/b5138f45-df93-483b-b00b-403c1a1ed093%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
