Graylog retention has any affect on shards?

I’m new to graylog.
I need to create a index set for 2 years.really confused how to set retention time with max indices.if i keep max number of indices high with 4 shards will it affect performance ?pls help

Graylog 2.4 in centos 7

Hello && Welcome

Now that’s a long time to hold data.

If your index rotation is set for a day then you would set your retention for 730

Example:

Yes it will, but it also depends on your searches specially if you have some 730 indices then multiply that by 4 you get 2920 shards. Elasticsearch will need resources plus the volume will need to be calculated for holding that many messages. Again this will depend on how many messages you are ingesting, for how long and what your search criteria is for dashboard and saved searches.

You may want to start read here for a better understand what you might need
.
https://docs.graylog.org/docs/getting-started

Also check out this post

Hope that helps

1 Like

Thanks for the reply we have settled on 1week per index with max of 110 weeks (2plus years)

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.