Graylog 6.0 - Data tiering for rotation and retention

[robertito (Roberto)]

Dear all, I have a Graylog 6.0 server.

I can see this Graylog version uses data tiering for rotation and retention as the default strategy, and the old stratregies (index time, index size, index message count) now are deprecated (I don’t know why).

Data tiering comes with 30 minimun days in storage and 40 maximum days in storage by default, but I change these to 120 minimum days in storage and 150 maximum days in storage.

Is it OK to change this values as above?

In case people from monitoring area ask me to retain logs for 8 months (240 days), is it possible or it’s no good to have too much indices?

Thanks in advance, regards!

[ihe]

HI Roberto,
with a lot of time you will collect a lot of data. Make sure, you have sufficient disk space available for this long time. Also keep you shard-number in mind: you should have on 20th of it as Heap in GB for your OpenSearch. The same amount should also be available to your OS for OpenSearch.