Reading Graylog Docs 0x00
https://docs.graylog.org/en/3.3/pages...
Where are ingested messages stored?
--only in Elasticsearch
How bad would loosing an Elasticsearch cluster be?
--horrible, unless you have baks of indices
What can a load balancer do in a bigger production setup?
--ping graylog nodes to see if alive, then take dead ones out.
fastest machine data processing engine on the planet
What's another name for the syslog stream?
--message cloud
What effects "seek time?"
--the location of the write "needle"
Why is putting the journal on disk in append only format (similar to Linkedin via Apache Kafka) a great idea?
--b/c messages won't get droped during spikes
Disruptor library from LMAX (high speed trading company)
Messages written into process buffer (ring).
Describe the CPU intensive part of the processing chain:
--msgs in the process buffer go through stream routing (?) and fields are extracted then sent to Elasticsearch(ES)
Where can fine tuning happen?
--processors per buffer (they should never exceed the # of cpu cores available)
What should happen if you see low throughput?
--increase # of processors in process buffer NOT output buffer.
What's Mongo used for?
--storying metadata like users, settings, and configs on streams, dashboards, extrators, etc.
Suggestion: run 3 instances
How does graylog connect to ES?
--as an embedded node that doesn't share data
What are shards good for?
--fast searches
Which questions should you ask when designing an index model?
--How much data do I have? How far back do I normally search? The answers will determine the size you make your indexes (which are then sharded).
What is the deflector?
--an index alias ''