add more stats and fix

This commit is contained in:
larssand
2026-06-30 12:23:23 +02:00
parent 4af316c739
commit e144cd8258
4 changed files with 29 additions and 5 deletions

View File

@@ -230,7 +230,9 @@ Graylog fetch mode controls how high-volume streams are read:
For high EPS environments, keep `graylog_range_seconds` at 300, set
`graylog_fetch_mode` to `auto` or `aggregate`, and use a modest raw sample such
as 5000. The dashboard then shows aggregate event volume without forcing every
raw log line through MCP each poll.
raw log line through MCP each poll. In aggregate mode the raw sample is capped at
10000 events per stream to stay within Graylog's default result-window limit;
aggregate counts are used for volume above that.
## Monitoring Export