Graylog / ElasticSearch Disk Compression

[Magneton (Jake Smith)]

Dear All,

Does anyone know if Graylog uses any form of disk compression when storing logs, other SIEM solutions use disk compression to reduce on disk footprint of logs.

I found this post about rotation at Message rotation and compression

I also found some discussion regarding compression in elasticsearch. Does Graylog enable this feature?

KInd Regards

Jake Smith

[jochen]

@Magneton

I also found some discussion regarding compression in elasticsearch. Does Graylog enable this feature?

Index compression is enabled by default in Elasticsearch.

You can customize the compression settings in a custom index template.

• Store compression in Lucene and Elasticsearch | Elastic Blog
• Index Modules | Elasticsearch Reference [5.6] | Elastic
• http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings

[Magneton (Jake Smith)]

Hi Jochen,

Cheers

Jake Smith