# Use case and explication for newbie

**URL:** <https://discuss.elastic.co/t/use-case-and-explication-for-newbie/20499>\
**Category:** Elasticsearch\
**Created:** [October 30, 2014, 2:03pm UTC](https://discuss.elastic.co/t/use-case-and-explication-for-newbie/20499 "2014-10-30T14:03:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![LordTamo](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@LordTamo](https://discuss.elastic.co/u/LordTamo)\
**Post date:** [October 30, 2014, 2:03pm UTC](https://discuss.elastic.co/t/use-case-and-explication-for-newbie/20499/1 "2014-10-30T14:03:29Z")

</div>

Hi all,

I'm french, excuse my poor english. 😉

in few words this is my case and my configuration :

- nxlog for eventslog and sending them to rsyslog in json.
- syslog on linux and aix servers
- rsyslog to receive and elasticsearch for indexation/save.

Elasticsearch :

- 1 node
- index.number\_of\_shards: 1
- index.number\_of\_replicas: 0

With nxlog, we've sent a whole windows eventslog to elasticsearch near  
6:30pm. Memory and CPU use grow up during the logs transfert (near  
10minutes) then CPU and memory down to normal. Few minutes later (~30mn),  
CPU/RAM occupation grew up again and stay to 100% on one CPU from 7pm to  
9am this morning until i restart elasticsearch service.  
This morning kibana won't respond and elasticsearch directory show indexes  
from years 2011, 2012 and 2013. I think i'ts because of old messages in the  
windows eventlog.

After restarting elasticsearch, everythings came to normal but i've lost  
all logs message between yesterday 7pm and today 9am.

[https://lh5.googleusercontent.com/-LkJcQF5fk5k/VFIaHXfBAUI/AAAAAAAALMQ/nx7vLKKEx7M/s1600/Capture.PNG](https://lh5.googleusercontent.com/-LkJcQF5fk5k/VFIaHXfBAUI/AAAAAAAALMQ/nx7vLKKEx7M/s1600/Capture.PNG)

This is what i think, can someone say me if i'm wrong or right ?

The server took in 10minutes near 500MB of logs with only 1 node and 1  
shard. The indexation start and took all the night. I stopped it too soon.  
All the logs in cue were lost when i've restart the service.

Have you some tweaks or tips to optimize my confirguration ?

Regards

Bastien

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/96297107-01ea-445a-a205-03fa03a24cdd%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/96297107-01ea-445a-a205-03fa03a24cdd%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:52am UTC](https://discuss.elastic.co/t/use-case-and-explication-for-newbie/20499/2 "2017-07-06T00:52:59Z")

</div>

Closed on July 6, 2017, 12:52am UTC