Thanks. For the benefit of anyone reading this who uses the AWS images,
which are based on Ubuntu and use Chef to (re)configure everything, it ends
up the relevant line is in
/opt/graylog/embedded/cookbooks/graylog/recipes/elasticsearch.rb:
:max_memory => "#{(node.memory.total.to_i * 0.6 ).floor / 1024}m"
I changed 0.6 to 0.3 and ran a graylog-ctl reconfigure, which results in
1185m instead of 2371m being thrown at it. I'll monitor and report back if
any problems. For now this is just a test installation and loads are very
low.
Still, it seems like the default AWS configuration is cutting it too close
to the 4GB the docs on its distribution page recommend. And I'm beginning
to see that using this image instead of a manual install onto a basic
Centos Amazon linux VM was a false savings of time...
On Monday, April 13, 2015 at 10:57:00 PM UTC+3, Arie wrote:
>
> 4 GB isn't a lot if you have it all on one machine.
>
> - You could start to give ES 1 GB of memory at max. (ES_HEAP_SIZE=1g) on
> centos in /etc/sysconfig/elasticsearch.
> - Second is to lower the field cache in elasticsearch.yml with:
>
> indices.fielddata.cache.size: 40% (or even lower)
>
> - Check is there is some swapping, this suf can't stand it.
> - Is there a lot of data stored and kept over time? ES tries to keep as
> much of the field data
> in memory as possible. If you do not need a lot of history, consider to
> keep data not
> that long, and configure graylog the correct way for this.
>
> Install a plugin to check how your instance of es is running.
>
> ...
--
You received this message because you are subscribed to the Google Groups
"graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
