/etc/sysconfig/graylog-server


JAVA=${JAVA_HOME}/bin/java
GRAYLOG_SERVER_JAVA_OPTS="-Xms31g -Xmx31g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -XX:MaxDirectMemorySize=8g -Djdk.nio.maxCachedBufferSize=262144 -Djmx.agent.port=9000 -Dcom.sun.management.jmxremote.access.file=/one/conf/jmxremote.access -Dcom.sun.management.jmxremote.password.file=/one/conf/jmxremote.password -javaagent:/one/lib/jmxagent.jar"
GRAYLOG_SERVER_ARGS="-d"
GRAYLOG_COMMAND_WRAPPER="authbind"
GRAYLOG_HTTP_PUBLISH_URI="https://${HOSTNAME}:443/"
GRAYLOG_HTTP_TLS_KEY_PASSWORD="${sslpassword}"
GRAYLOG_PASSWORD_SECRET="${graylogpassword}"

---------------------
/etc/graylog/server/server.conf



is_master=false

node_id_file = /etc/graylog/server/node-id
root_username = admin
root_password_sha2 = SHA

bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin

root_timezone = Etc/GMT-3

http_bind_address = 0.0.0.0:443
http_enable_tls = true
http_tls_cert_file = /path/to/crt
http_tls_key_file = /path/to/pem
http_connect_timeout = 500s
http_read_timeout = 500s
http_write_timeout = 500s

rotation_strategy = time
retention_strategy = delete

allow_leading_wildcard_searches = true
allow_highlighting = true

index_ranges_cleanup_interval = 8h
index_field_type_periodical_interval = 8h


output_batch_size = 5000

output_flush_interval = 10
output_fault_count_threshold = 3
output_fault_penalty_seconds = 10
outputbuffer_processor_keep_alive_time = 5000
outputbuffer_processor_threads_core_pool_size = 6
outputbuffer_processor_threads_max_pool_size = 60
processbuffer_processors = 36
outputbuffer_processors = 72

processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 30
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
message_journal_max_size = 12gb
message_journal_flush_age = 10m
message_journal_max_age = 720h

async_eventbus_processors = 12

lb_recognition_period_seconds = 3
lb_throttle_threshold_percentage = 70

stream_processing_timeout = 10000
stream_processing_max_faults = 3

output_module_timeout = 10000

stale_master_timeout = 15000

shutdown_timeout = 30000

index_optimization_max_num_segments = 1

gc_warning_threshold = 1s

ldap_connection_timeout = 8000
proxied_requests_thread_pool_size = 32

elasticsearch_hosts = http://10.19.172.130:9200,http://10.23.131.255:9200,http://10.19.172.131:9200,http://10.19.172.133:9200,http://10.19.172.128:9200,http://10.19.172.129:9200,http://10.19.172.132:9200,http://10.19.172.134:9200,http://10.23.131.254:9200,http://10.19.172.135:9200,http://10.18.172.135:9200,http://10.18.172.134:9200,http://10.18.172.128:9200,http://10.18.172.130:9200,http://10.22.131.255:9200,http://10.22.131.254:9200,http://10.18.172.129:9200,http://10.18.172.133:9200,http://10.18.172.131:9200,http://10.18.172.132:9200,http://10.17.172.131:9200,http://10.21.131.254:9200,http://10.17.172.134:9200,http://10.17.172.128:9200,http://10.21.131.255:9200,http://10.17.172.130:9200,http://10.17.172.133:9200,http://10.17.172.135:9200,http://10.17.172.129:9200,http://10.17.172.132:9200,http://10.20.131.137:9200,http://10.20.131.134:9200,http://10.20.131.135:9200,http://10.20.131.139:9200,http://10.20.131.140:9200,http://10.20.131.143:9200,http://10.20.131.138:9200,http://10.20.131.136:9200,http://10.20.131.142:9200,http://10.20.131.141:9200
elasticsearch_max_time_per_index = 2d
elasticsearch_max_number_of_indices = 15
elasticsearch_shards = 360
elasticsearch_replicas = 1
elasticsearch_index_prefix = graylog
elasticsearch_discovery_enabled = true
elasticsearch_discovery_filter = type:coordinator
elasticsearch_disable_version_check = false
elasticsearch_connect_timeout = 300s
elasticsearch_max_total_connections = 100
elasticsearch_max_total_connections_per_route = 5
elasticsearch_max_retries = 10
elasticsearch_index_optimization_jobs = 360
elasticsearch_discovery_frequency = 5s
elasticsearch_socket_timeout = 300s
elasticsearch_analyzer = standard
elasticsearch_request_timeout = 10m
elasticsearch_index_optimization_timeout = 4h


mongodb_uri = mongodb://graylog:pass@10.18.161.192:27017,10.18.161.193:27017,10.19.161.192:27017,10.16.161.192:27017,10.17.161.192:27017/graylog?replicaSet=graylog&journal=true&w=majority&wtimeoutMS=10000&retryWrites=true
mongodb_max_connections = 100
mongodb_threads_allowed_to_block_multiplier = 60