Hi there I tried to do what I thought was a simple search across a week's worth of data on a single-box graylog server (ie it also has ES and mongodb on it)
Basically I did a search for "fieldname:value1 OR fieldname:value2 OR fieldname:value3" over 7days and graylog just sat there spinning it's wheels (before hand I was happily doing searches that weren't causing any grief at all) The CPU on the graylog server went through the roof, graylog error file showed no problem, but ES logs showed a bunch of these indices.breaker.fielddata] [fielddata] New used memory 11155918063 [10.3gb] for data of [message] would be larger than configured breaker: 10857952051 [10.1gb], breaking After five minutes of graylog just sitting there, I restarted ES, but graylog was now borked. The input channels were still receiving data, but nothing was flowing out. So I restarted graylog and all was good again Is this expected behaviour, and if so, what is needed to stop it? I've seen other non-graylog related postings on the ES list about this happening with large clusters, so it seems to be an error case for ES, but I'm more concerned over how graylog reacted: ie why didn't it give up and give me an error page for starters. It looks to me like graylog didn't expect that ES search to error out and that caused it to block? (I'm assuming ES generated an error - the logs shows that WARN - I dunno what happens next) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CAFChrg%2BMzp5Cr_vQtQ1Gsjd5SyF5qrSxgmp-0SR%3DgW_5xP4gGg%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
