On Wed, Aug 01, 2012 at 01:26 +0000, you wrote: > This seems to me to just be an issue of my ElasticSearch server not > keeping up with the load. Good (for Bro, not for the ES server :-). Thanks for the update. Robin -- Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org