Archiving / Log Retention without Graylog Enterprise


#1

What does everyone use currently (besides the archiving plugin in Graylog Enterprise) to control disk usage / retention / deleting of old logs?

I would like to keep 1 day of current logs, and 1 week of retained logs and then rotate deleting on the 8th day.

Thanks


(Beth) #2

Hi,

Your needs seem real simple. Just configure your index from the Graylog interface. Click on System/Indices, then click on the hyperlink for your index. Edit your index as follows:

Index rotation strategy: Index Time
Rotation Period: P1D (1d, a day)
Index Retention Strategy: Delete Index
Max number of indices: 8

Beth