原文地址：http://docs.graylog.org/en/latest/pages/architecture.html

Architectural considerations

There are a few rules of thumb when scaling resources for Graylog:

  • graylog-server nodes should have a focus on CPU power.
  • Elasticsearch nodes should have as much RAM as possible and the fastest disks you can get. Everything depends on I/O speed here.
  • MongoDB is only being used to store configuration and the dead letter messages, and can be sized fairly small.
  • graylog-web-interface nodes are mostly waiting for HTTP answers of the rest of the system and can also be rather small.
  • graylog-radio nodes act as workers. They don’t know each other and you can shut them down at any point in time without changing the cluster state at all.

Also keep in mind that messages are only stored in Elasticsearch. If you have data loss on Elasticsearch, the messages are gone - except if you have created backups of the indices.

MongoDB is only storing meta information and will be abstracted with a general database layer in future versions. This will allow you to use other databases like MySQL instead.

Minimum setup

This is a minimum Graylog setup that can be used for smaller, non-critical, or test setups. None of the components is redundant but it is easy and quick to setup.

Bigger production setup

This is a setup for bigger production environments. It has several graylog-server nodes behind a load balancer that share the processing load. The load balancer can ping the graylog-server nodes via REST/HTTP to check if they are alive and take dead nodes out of the cluster.

Highly available setup with Graylog Radio

Beginning with Graylog 1.0 on we do no longer recommend running Graylog Radio because we are now using a high-performant message journal (from the Apache Kafka project) in every graylog-server instance which is spooling all incoming messages to disk immediately and is able to buffer load spikes just at least as good as Graylog Radio was, but with less dependencies and maintenance overhead.

If you are running a setup with Graylog Radio we recommend to shut down the Graylog Radio architecture including AMQP or Kafka brokers completely and directly send messages to thegraylog-server nodes. If you have been using Graylog Radio for load balancing, you should now put a classic load balancer in front of your graylog-server nodes.

This approach has been proven to work great in large high-throughput setups of several of our large scale customers and immensely reduced complexity of their setups.

The Kafka and AMQP inputs are still supported and can be used to build a custom setup using message brokers, if you want to keep using that. A reason for this might be that Graylog is not the only subscriber to the messages on the bus. However we would recommend to use Graylog forwarders to either write to a message bus after processing or write to other systems directly.

最新文章

  1. Matlab学习笔记（一）—— 三维图形绘制
  2. Next Permutation
  3. 让VS2010/VS2012添加新类时自动添加public关键字
  4. 洛谷P1113 杂物
  5. struct stat 作用
  6. java实现二叉树的相关操作
  7. js传递数组到后台
  8. WebSocket 详解教程
  9. 全志A33移植LCD驱动(ILI9806E)
  10. Mybatis 传递多个参数
  11. quick-cocos2d-x lua框架解析（一）对UI进行操作的UiUtil脚本
  12. 微软BI 之SSAS 系列 - 多维数据集维度用法之二 事实维度(退化维度 Degenerate Dimension)
  13. U启动制作U盘启动盘详细教程
  14. Spring设置动态定时任务
  15. Mysql之数据表操作
  16. 比較C struct 與 C# unsafe struct内存分佈
  17. java unicode转码为中文　实例
  18. UI5-文档-4.15-Nested Views
  19. FFMPEG视音频编解码零基础学习方法 【荐】
  20. django系列8.5--使用装饰器(视图函数中)实现用户登录状态检验

热门文章

  1. MATLAB常用数据类型的转换
  2. [LeetCode] Remove Element 分析
  3. 导入CSV文件之后出现换行符问题
  4. CentOS上firefox安装flash
  5. java的Socket通信例子及关于java.net.SocketException: Socket is closed错误
  6. POJ 3312 Mahershalalhashbaz, Nebuchadnezzar, and Billy Bob Benjamin Go to the Regionals (水题，贪心)
  7. 第三方类AFNetworking
  8. 自己学会汉化DevExpress控件[转]
  9. Javascript继承实现
  10. java web，生成验证码图片的技术