I am looking into getting Graylog Open for a private Test if it can live up to my expectations.
While reading the Documentation for 5.2 Graylog Open I stumbeld over the part the Archiving is part of the Graylog Operations Version.
Does this mean I , with a free version, can’t look at my logs that got send to Graylog 20 days ago?
All I would need is a 30 Day retention period to look through and search the looks manually for special Cases.
Thanks in Advance
You can store as much data as you want for as long as you want in Graylog Open. However, the more data you store in Opensearch the more resources it requires (not just disk space).
In practice at 30 or even 90 days that is totally worth it, but longer than that the chance you will look at those logs goes down, and therefore the cost to value goes up.
What the archive feature in the commercial versions of Graylog gives you is the ability to take that data and move it “offline” in a compressed format, but then later you can easily restore that data back into Graylog if you ever need to work with it.
Ah. Thanks. Yeah no I feel kinda dump. Have a great Day mate
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
