Graylog filled my disk, how do I delete some data?

Graylog Central (peer support)
1

Hi,

So graylog filled up my root completly, the webpages doesn’t load anymore (/ and /api).

How can I clean some data (I don’t really care about it, but I’d like to retain some, mostly recent, data)?

Thank you,

Alexis

2

He @ave314

without knowledge about your installation I can only give the advice:

  • select some indices that can be deleted
  • delete them from elasticsearch via api (of elasticsearch)
  • start Graylog and recalculate the index size ( System > Indices)
3

Hey jan,

The web pages doesn’t load.

My installation is on a Centos 7 VM, installed with the docs installation guide.

What I am taking out of your response :
I need to find the command line that will delete some indices from elasticsearch.

EDIT :
This reboot allowed me access to the web interface. I still went with those command :

First aid: check which indices are present:
curl http://localhost:9200/_cat/indices

Then delete the oldest indices (you should not delete all)

curl -XDELETE http://localhost:9200/graylog_1
curl -XDELETE http://localhost:9200/graylog_2
curl -XDELETE http://localhost:9200/graylog_3
4

Hi @ave314,

I always move my data to a separate partition attached to my system as per Graylog manual,.

Just a tip from someone who learned this mistake early on as well.

Kind Regards

Jake

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.