Graylog index name

Graylog Central (peer support)
1

Hello!
I am currently using Graylog 2.1.0.

In the indices section of Graylog, I can update the index setting(rotation configuration) to one of these options.

  1. index message count
  2. index size
  3. index time

My question: Is it possible to set index name like graylog_YYMMDD_{auto increment if current index size reaches 4GB} which is combination of option 3 and 2?

I want the index name to be like this in order to search the right index optimally and also limit the size of the index so that it doesn’t get too big.

If you have any idea how to approach this problem, please help me!

Thanks.

2

Hej @puremad

the chosen schema is not possible. For the Naming of the Indices that looks similar than this

You need to decide on one option.

3

Thanks for you comment @jan!

4

This assumes that log messages are ingested with a strict monotonically increasing timestamp and are basically sent and indexed instantly, which is not the case.