Reading Graylog Docs 0x00

https://docs.graylog.org/en/3.3/pages/architecture.html
Where are ingested messages stored?
--only in Elasticsearch

How bad would loosing an Elasticsearch cluster be?
--horrible, unless you have baks of indices

What can a load balancer do in a bigger production setup?
--ping graylog nodes to see if alive, then take dead ones out.

fastest machine data processing engine on the planet

What's another name for the syslog stream?
--message cloud

What effects "seek time?"
--the location of the write "needle"

Why is putting the journal on disk in append only format (similar to Linkedin via Apache Kafka) a great idea?
--b/c messages won't get droped during spikes

Disruptor library from LMAX (high speed trading company)

Messages written into process buffer (ring).

Describe the CPU intensive part of the processing chain:
--msgs in the process buffer go through stream routing (?) and fields are extracted then sent to Elasticsearch(ES)

Where can fine tuning happen?
--processors per buffer (they should never exceed the # of cpu cores available)

What should happen if you see low throughput?
--increase # of processors in process buffer NOT output buffer.

What's Mongo used for?
--storying metadata like users, settings, and configs on streams, dashboards, extrators, etc.

Suggestion: run 3 instances

How does graylog connect to ES?
--as an embedded node that doesn't share data

What are shards good for?
--fast searches

Which questions should you ask when designing an index model?
--How much data do I have? How far back do I normally search? The answers will determine the size you make your indexes (which are then sharded).

What is the deflector?
--an index alias ''