Im just getting familiar with graylog.
My goal is to store the logs for 6 months.
At the beginning, I set the index size to 20.000 just for testing. The system went live and I changed
Rotation period: P1d
Max Number of indices: 184
But right now (18.01.2018, 08:36h), I can see on the oldest index:
graylog_9 Contains messages from 6 months ago up to 6 months ago
When I hover over the time, I get
graylog_9 Contains messages from <4.7.2017> ago up to 6.7.2017
How can I get a working retention policy?