Hello graylog community,
this time I have tricky question.
I am running several index templates like “logs_r01m”, “logs_r06m”, “logs_r12m”.
All of these index templates use time-based rotation and were created at the same time, so their current write indices points to logs_r01m_736, logs_r06m_736 and logs_r12m_736 respectively.
Now I need to create a new index set “logs_r03m” for a 3M retention period, but I’d like to keep its numbering synchronized. Is there a comfortable way to get its current write index to point to logs_r03m_736?
I know I can press “index maintenance > rotate active write index” 736 times, but that is hardly comfortable and will get only worse.