Pls. follow the screenshot where I marked what is wrong (red line), what was right (blue line). The case it that graylog suddenly stopped to respect Max Index Size retention strategy. Only for single index-set (I have dozen others configured, all are good.). Can I provide you more data ?
Best regards
Wojciech Maryszczak