Cluster Configuration

The Cluster Configuration page provides a centralized, real-time view of all nodes in your deployment, offering critical insight into roles, processing states, and load balancer status. This visibility helps administrators monitor system health, troubleshoot performance issues, and make informed decisions during scaling or maintenance.

This topic describes the metrics available for different node types as well as the node management activities administrators can perform here.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

You must be a Graylog administrator or a user with the Cluster Configuration Reader role to access the Cluster Configuration page.

Node Management

Navigate to the Cluster Configuration page at System > Cluster Configuration. This page shows all the nodes in your deployment, with each node type shown in a separate table that displays key metrics specific to the node:

Graylog Nodes
Data Nodes
MongoDB Nodes

Use the Columns dropdown at the upper-left of each table to customize which metrics appear. You can drag columns to reorder as you like. Note that some columns have a small arrow beside the title to indicate you can sort by these metrics (ascending/descending).

Some metrics in the tables have pre-set warning and caution thresholds. When a warning is exceeded, the metric displays with a red banner to indicate a potential constraint. When a caution level is exceeded, the metric displays with a yellow banner. The metrics that include this feature are statuses, CPU usage, and memory and storage usage.

Just above the tables, you can use the search field to locate specific nodes, or select the toggles to view only a single type of node. These features are particularly useful to focus your view if you have many nodes in your environment.

See the sections below for specific metrics and actions available for each node type.

Graylog Nodes

Specific node metrics are also available from the Actions menu, including viewing all inputs running on the node, a thread dump of all active threads or process buffers, and recent system logs.

The Graylog Nodes table on the Cluster Configuration page displays information about each Graylog node, including node roles, processing state, load balancer status, Graylog version, memory usage, and processing metrics. Use the Columns dropdown to add or remove columns from the table. Note that not all information is displayed by default.

From the More menu for each node, administrators can pause message processing or change the node’s load balancer status to DEAD. When a node is marked DEAD, the load balancer does not send log messages to that Graylog node.

Hint: When you pause message processing, the process buffers stop accepting new messages. If the message journal is enabled on the node (which is the default setting), Graylog continues to persist incoming messages to disk. Therefore, no data is lost and processing can safely resume when the node is re-enabled.

Select a node from the Node column to open the node detail page. This page displays detailed status and performance information, including JVM resource usage, message throughput, real-time disk journal utilization, and installed components and inputs lists.

Additional diagnostic options are available from the Actions menu, including loading a thread dump or process-buffer dump and viewing extensive internal metrics for monitoring and debugging.

Data Nodes

The Data Nodes table on the Cluster Configuration page displays node roles and node status for each Data Node. This section also shows the version of Graylog each node is running along with CPU, memory, and storage statistics. As with other tables, you can customize the displayed metrics from the Columns dropdown.

From the More menu, administrators can renew Data Node certificates, stop or remove nodes, and display recent system logs.

Data Node Management

At the top of the Cluster Configuration page, you can navigate to additional tabs for Data Node management, including:

Certificate Management: From here, you can issue or renew certificates for all Data Nodes in your cluster. See Manage Certificates with Data Node for more information.
Data Node Dashboard: This page displays additional performance metrics for each Data Node.
Data Node Upgrade: Navigate to this page for guidance on upgrading your Data Nodes. See Upgrade Graylog for more information on this process.

Hint: If you have not yet migrated to Data Node as your search backend, note that the only tab visible will be Data Node Migration. See Data Node Migration for more information on this process.

MongoDB Nodes

The MongoDB Nodes table on the Cluster Configuration page displays node roles and the current MongoDB version of the node along with performance metrics. Note that by default,Profiling Level is set to Off. Select Enable Profiling above the table to receive additional data to identify slow queries and troubleshoot performance issues across cluster nodes.

Hint: Using profiling can cause reduced performance of your clusters. We recommend you leave profiling disabled when not in use.

As with other tables, you can customize the displayed metrics from the Columns dropdown.