Accessing old index

[tatuh]

Hi,

I need to access older data on Graylog, is there a way to read older indexes? Currently we have only one week visible in Graylog. We have configuration for elasticsearch_max_docs_per_index = 20000000, and if I have understood correctly after this limit is reached new index is created for storing log data.

I found several files in /var/lib/elasticsearch/nodes/0/indices -folder, are these possibly the old index files, or how/where are they stored? Dates of files in /indices folder are not so clear, as files are updated on same days…)
Also how can I check the backup/rotation policy for indexes?

Graylog version: Graylog 2.3.2

Kind regards,
Tatuh

[jrunu]

Hi Tatuh,

here you can find information on the index set design, for your version. It also goes into the configuration of the retention policy.

Janosch

[macko003]

1. the graylog config file’s setting is only for the first start. Check your web UI.
2. if you just close the index, reopen it.
3. If you delete the old indexes:
   Restore your data from your backup.
   Before it dont forget to increase the retention period.
   If you have problem with the restore, open your disaster recovery documents.
   No other method to restore deleted files/logs.
   If you dont have backup, and disaster recovery docs, I suggest to make good.