Hello, can you please help me with estimation of disk size. I have very simple setup one Fortigate logging via syslog to Graylog ~200 EPS. Thank you! Jiri

Hi Jiri, how big are the log messages on average? How long do you want to keep data until it will be deleted?

Hi Jochen, already discussing in this thread: [image] Message retention Graylog Central (peer support) Hello, I would like to store logs for one year then delete. Are following values correct? According to ISO 8601 one day is P1D is so rotation period set to:P1D Selec…

It looks like you already have all the information you need. 365 * (200 * 60 * 60 * 24) * $AVERAGE_MESSAGE_SIZE * (1 + $NUMBER_OF_REPLICAS) * 1.5 [days] * [messages per day] * [average message size] * [number of times the data is stored in ES] * [magic number for the disk s…

1,5 is default magic value configured in graylog? Thank you very much! Jiri

[image] colbik: 1,5 is default magic value configured in graylog? No, that’s an approximation for how many bytes are required in an Elasticsearch index to store 1 byte of text (due to secondary data structures such as the inverted indices of Lucene).

Estimating disk size

Graylog Central (peer support)

colbik (Jiri Kolb) February 22, 2017, 9:13am 3

Hi Jochen,
already discussing in this thread:

Thank you for your answer!

Jiri

Topic		Replies	Views
Message retention Graylog Central (peer support)	4	10428	February 22, 2017
Keep logs for a year in GrayLog Graylog Central (peer support)	4	3620	December 30, 2017
Raw log data consumption Graylog Central (peer support)	4	2029	June 8, 2017
Confused on why I'm not storing as much as I expected Graylog Central (peer support)	2	511	August 22, 2017
Graylog Server minimum requirements Graylog Central (peer support)	3	4686	July 9, 2019

Estimating disk size

Related topics