Changing Message Retention

Graylog Central (peer support)
1

Hello,

Im just getting familiar with graylog.

My goal is to store the logs for 6 months.

At the beginning, I set the index size to 20.000 just for testing. The system went live and I changed

Rotation period: P1d
Max Number of indices: 184
retention-strategy: Delete

But right now (18.01.2018, 08:36h), I can see on the oldest index:

graylog_9 Contains messages from 6 months ago up to 6 months ago

When I hover over the time, I get

graylog_9 Contains messages from <4.7.2017> ago up to 6.7.2017

How can I get a working retention policy?

Thanks!

kind regards
Philipp

2

How many indices were there in the beginning with the testing retention settings?

I suggest you check that and if you need to keep those indices, use number of indices 184 + nr of test indices. When it is 6 months from the start of the new retention settings, you can change the max number of indices back to 184.

3

No I dont want to keep the test indices.

I want to have the oldest index from 6 months ago …

4

How many indices are currently in the index set you’ve configured the mentioned rotation strategy for?
If it’s less than 184, everything is working as expected and Graylog will automatically delete indices once there are more than 184 indices in that index set.

If you don’t want to wait until the automatic rotation kicks in, you can manually delete all indices you don’t want to keep.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.