Graylog Indices with problem

Good afternoon people

I set my Max number of indices = 20
Select retention strategy = Delete index

But, I already have 36 indices and it doesn’t stop increasing. Max number of indices is not running. I’m deleting the indexes manually.

Does anyone know what the problem is? It is consuming a lot of disk resource.

Thanks.

How are you deleting them, via the Graylog GUI? Have you tried recalculating the index ranges? (System->Indicies->click on the index, click on maintenance button…) Have you looked in your Graylog log files? Graylog will post in there when it makes retention adjustments and ought to post an error if it was failing.

tail -f /var/log/graylog-server/server.log

You could rotate indices manually to get a reaction in the logs

Are there any health issues with Elasticsearch:

curl -XGET http://localhost:9200/_cat/indices?pretty

and/or:

curl -XGET http://localhost:9200/_cluster/allocation/explain?pretty

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.