Hi everyone,
I’m troubleshooting an issue with our Graylog deployment and would appreciate some guidance.
Environment
-
Graylog Version: 6.1.16
-
Datanode Version: 6.1.16
-
Operating System: Amazon Linux 2
-
Storage usage: 20G (/var/lib/graylog-datanode)
Problem
Our Graylog server previously retained approximately three months of logs. Recently, we noticed that only the last 30 days of logs are available, and older logs have disappeared.
We did not intentionally change the retention policy, and log ingestion is continuing normally.
Current Behavior
-
Last 30 days: logs are available
-
Last 90 days: no results
-
Searches work correctly for recent logs
What we’ve checked
-
Verified the Graylog index set configuration
-
Reviewed retention settings
-
Checked rotation strategy
-
Did not find any obvious configuration changes
-
Confirmed that Graylog service is running normally
Questions
-
What could cause Graylog to suddenly retain only one month of logs when it previously retained around three months?
-
Which configuration files or settings should be checked first?
-
Could OpenSearch/Elasticsearch automatically delete older indices due to another policy?
-
Are there common reasons why historical indices disappear even when Graylog itself appears correctly configured?
If it helps, I can also provide:
-
Index Set configuration
-
Rotation and retention settings
-
Screenshots of the Index Set
-
Output from the Graylog server
-
OpenSearch/Elasticsearch index information
Disk usage details
Any suggestions on where to investigate next would be greatly appreciated. Thank you!