When I go to System/Indices, I can see how large each of my indices is. My question is, since those indices are stored in Elasticsearch, does the database grow at the same rate as the indices/disk usage? (My index rotation is set to 1 day so I have one index for each day.)
For example, if I see that yesterday’s index was about 100MB, could I assume that my Elasticsearch database grew by 100MB? And could I assume that the amount of disk space used increased by 100MB?
If your referring to MongoDb, just a little. MongoDb only hold Metadata. I think mine is only 30 GB after 7 years.
Correct… This depends on the retention set ( delete. close, archive, Do nothing) . When setting up Graylog I checked the amount of logs per day & size of my indices to do my calculation on the sum per day then used that to create the volume need for 30 Days.