Skip to content

Instantly share code, notes, and snippets.

@domino14

domino14/gist:4506893

Created January 11, 2013 00:10
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save domino14/4506893 to your computer and use it in GitHub Desktop.
Save domino14/4506893 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
"Yeah, I fought this and it was the horrible JVM running out of memory and swapping like crazy (crashing our process usually). We made the changes below:
In the elasticsearch.yml config:
index.cache.filter.expire: 10m
index.cache.field.expire: 10m
index.cache.field.type: soft
We had 10m expires because we *rarely* (if ever) did the same ES search again. The soft setting just means to evacuate stale caches as needed (which shouldn't happen if caches are that low). Or, that is my understanding.
Next, you'll want to limit the memory the JVM gets for both ES (!) and graylog. For us, that is a java arg like -Xms1g -Xmx14g (That is for a 17.5gb memory machine.) I think we had to set that in some settings file like /etc/default/elasticsearch:
ES_MIN_MEM="1g"
ES_MAX_MEM="14g"
If you use the fancy "graylog2ctl" command, you might have to toy with the script itself, but it is the same process with the command line arg (https://github.com/Graylog2/graylog2-server/wiki/Starting-the-server)."
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment