anchor.diff:  # For optimum performance your LogMessage objects in the ring buffer should fit in your CPU L3 cache.
   # Start server with --statistics flag to see buffer utilization.
   # Must be a power of 2. (512, 1024, 2048, ...)
  -ring_size = 1024
  +ring_size = 65536
  +
  +inputbuffer_ring_size = 65536
  +inputbuffer_processors = 2
  +inputbuffer_wait_strategy = blocking
  +
  +# Enable the disk based message journal.
  +message_journal_enabled = true
  +
  +# The directory which will be used to store the message journal. The directory must me exclusively used by Graylog and
  +# must not contain any other files than the ones created by Graylog itself.
  +message_journal_dir = <%= node['graylog']['graylog-server']['journal_directory'] %>
  +
  +# Journal hold messages before they could be written to Elasticsearch.
  +# For a maximum of 12 hours or 5 GB whichever happens first.
  +# During normal operation the journal will be smaller.
  +#message_journal_max_age = 12h
  +#message_journal_max_size = 5gb
  +#message_journal_flush_age = 1m
  +#message_journal_flush_interval = 1000000
  +#message_journal_segment_age = 1h
  +#message_journal_segment_size = 100mb
  +
  +# Number of threads used exclusively for dispatching internal events. Default is 2.
  +#async_eventbus_processors = 2
   
   # EXPERIMENTAL: Dead Letters
   # Every failed indexing attempt is logged by default and made visible in the web-interface. You can enable
  
positive.code: # reached within output_flush_interval seconds, everything that is available will be flushed at once. Remember
  # that every outputbuffer processor manages its own batch and performs its own batch write calls.
  # ("outputbuffer_processors" variable)
  output_batch_size = 25
  
  # Flush interval (in seconds) for the Elasticsearch output. This is the maximum amount of time between two
  # batches of messages written to Elasticsearch. It is only effective at all if your minimum number of messages
  # for this time period is less than output_batch_size * outputbuffer_processors.
  output_flush_interval = 1
  
  # The number of parallel running processors.
  # Raise this number if your buffers are filling up.
  
negative.code: 
  # use a different port if you run multiple Elasticsearch nodes on one machine
  #elasticsearch_transport_tcp_port = 9350
  
  # we don't need to run the embedded HTTP server here
  #elasticsearch_http_enabled = false
  
  