# Graylog and index.refresh\_interval **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [October 16, 2017, 8:08am UTC](https://community.graylog.org/t/graylog-and-index-refresh-interval/2794 "2017-10-16T08:08:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Loompaz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/loompaz/32/668_2.png) [@Loompaz](https://community.graylog.org/u/Loompaz)\ **Post date:** [October 16, 2017, 8:08am UTC](https://community.graylog.org/t/graylog-and-index-refresh-interval/2794/1 "2017-10-16T08:08:17Z")
Hello everybody, Graylog version : 2.2.3 ES version : 2.4.2 I’m asking how do you configure the (elastic) index.refresh\_interval in your graylog environment ? I’ve read that it could be possible to do this by : - configuring elasticsearch.yml (but some has reported that this doesn’t work) - index setting (but it seems that it not applied on every new index) - updating graylog template (but I don’t want to break my graylog install ! ;-)) So what is the best/more effective way to achieve this ? I 'm looking for a solution where the setting is **applied on every new index** Also, do you know any way to get actual index.refresh\_interval setting ? I tried with `curl localhost:9200/graylog_*?pretty=true` but no trace of index.refresh\_interval Thanks for your advice ! ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [October 16, 2017, 8:54am UTC](https://community.graylog.org/t/graylog-and-index-refresh-interval/2794/2 "2017-10-16T08:54:27Z")
> [@Loompaz](#): > > updating graylog template (but I don’t want to break my graylog install ! ;-)) Create your own index template: [http://docs.graylog.org/en/2.3/pages/configuration/elasticsearch.html#custom-index-mappings](http://docs.graylog.org/en/2.3/pages/configuration/elasticsearch.html#custom-index-mappings) ---
**Author:** ![Loompaz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/loompaz/32/668_2.png) [@Loompaz](https://community.graylog.org/u/Loompaz)\ **Post date:** [October 16, 2017, 10:00am UTC](https://community.graylog.org/t/graylog-and-index-refresh-interval/2794/3 "2017-10-16T10:00:55Z")
OK @jochen . So If my understanding is good, I would have to create the following graylog-custom-mapping.json : ``` { "template": "graylog_*", "settings": { "index.refresh_interval" : "30s" } } ``` And then -\> `curl -X PUT -d @'graylog-custom-mapping.json' 'http://localhost:9200/_template/graylog-custom-mapping?pretty'` ? Thanks for your help ! ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [October 16, 2017, 10:08am UTC](https://community.graylog.org/t/graylog-and-index-refresh-interval/2794/4 "2017-10-16T10:08:13Z")
Close, but no cigar. > **[Possible to set default refresh\_interval for all new indices?](https://discuss.elastic.co/t/possible-to-set-default-refresh-interval-for-all-new-indices/57993/3?u=joschi)** > > Excellent, thank you very much. For future reference to others viewing, this worked for me: curl -XPUT hostname:9200:/\_template/all\_indices -d ' { "template": "\*", "settings": { "refresh\_interval": "30s" } } \` ---
**Author:** ![Loompaz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/loompaz/32/668_2.png) [@Loompaz](https://community.graylog.org/u/Loompaz)\ **Post date:** [October 16, 2017, 10:46am UTC](https://community.graylog.org/t/graylog-and-index-refresh-interval/2794/5 "2017-10-16T10:46:58Z")
Yes thank you @jochen it works ! I forced an index rotation and now I can see the refresh interval set to 30 sec: **curl localhost:9200/graylog\_193?pretty=true** ``` { "graylog_193" : { "aliases" : { "graylog_deflector" : { } }, "mappings" : { "message" : { "dynamic_templates" : [ { "internal_fields" : { "mapping" : { "index" : "not_analyzed", "type" : "string" }, "match" : "gl2_*" } }, { "store_generic" : { "mapping" : { "index" : "not_analyzed" }, "match" : "*" } } ], "properties" : { "@timestamp" : { "type" : "date", "format" : "strict_date_optional_time||epoch_millis" }, "AccessList" : { "type" : "string", "index" : "not_analyzed" }, "type" : { "type" : "string", "index" : "not_analyzed" }, ``` […] ``` "user" : { "type" : "string", "index" : "not_analyzed" } } } }, "settings" : { "index" : { "refresh_interval" : "30s", "number_of_shards" : "3", "creation_date" : "1508149701125", "analysis" : { "analyzer" : { "analyzer_keyword" : { "filter" : "lowercase", "tokenizer" : "keyword" } } }, "number_of_replicas" : "1", "uuid" : "Iav6nc8aTgq_EOiM6xrGcg", "version" : { "created" : "2040299" } } }, "warmers" : { } } } ``` Just to confirm, if I apply the template on graylog\_\*, this will only apply on actual and not future index automatically ? ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [October 16, 2017, 11:36am UTC](https://community.graylog.org/t/graylog-and-index-refresh-interval/2794/6 "2017-10-16T11:36:39Z")
> [@Loompaz](#): > > Just to confirm, if I apply the template on graylog\_\*, this will only apply on actual and not future index automatically ? Yes, correct. Index templates are only applied when creating new indices. This being said, make sure to include all index prefixes you have in other index sets and not just `graylog_*`, if you want to apply the settings to _all_ newly created indices. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [October 30, 2017, 11:36am UTC](https://community.graylog.org/t/graylog-and-index-refresh-interval/2794/7 "2017-10-30T11:36:54Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.