Previously my index was set to store logs for about 4 years. That was my first, initial, and not quite a wise setting. But it was, and it worked.
Unfortunatelly partition where folder /var is mounted (where I think logs from Graylog are stored) is occupied in 55%. I think this causes that index in Graylog won’t accept new logs - it shows " There were 204,800 failed indexing attempts in the last 24 hours."
Few days ago I changed index roration period from 4 years to P1W (7d, 7 days) but It does not delete old logs. Previously index has 20.7GB and today also it have exact the same size.
What should I change to delete old logs?