I've got a stop-gap measure in place that keeps things above our latency thresholds for now, and we're at the max number of cores available to us in EC2, running 32 cores and 60G mem.
As for version we're on 6.6.3, and can't upgrade to 7 because we won't upgrade the old forwarders on existing systems. (lack of willingness, not lack of technical means)
We do not have a deployment server and are baking the hostname in the outputs.conf.
Before the stop-gap, the Parsing, Merging, and Typing pipelines were at 100%, indexing at 0%
... View more