Hello,
I got the task to configure graylog to keep log files for 6 months.
At the moment, the index rotation type is by size with a special number of logs to keep.
I want to change to every 12 hours and keep 365 indices. (365*12=4380=6 Months)
What happens if I change the rotation? Does graylog recalculate all older indices? Are they affected from keeping only 6 Months?
kind regards
Philipp
When changing the rotation strategy of an index set, Graylog will adhere to that configuration starting with the current write-active index but not for the existing ones.
When changing the retention strategy (close, delete; number of indices) of an index set, Graylog will adhere to that configuration for all indices, e. g. if you configured to keep 20 indices before and now configured 10 indices, Graylog would delete (or close) all indices over that number.
Thanks for the reply.
So my index_01 … index_90 are rotated by size.
I changed the settings.
index_91 is rotated by date.
If the 6 months are over, do index_01 … index_90 get cleaned? Or does the time calculations start at index_91?
kind regards
Philipp
The retention runs over all indices (and not just every 6 months, but every few minutes). Depending on your configuration, the oldest indices will be closed or deleted until the number of configured indices has been reached (e. g. 365).
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
