Graylog retention has any affect on shards?

Hello && Welcome

Now that’s a long time to hold data.

If your index rotation is set for a day then you would set your retention for 730


Yes it will, but it also depends on your searches specially if you have some 730 indices then multiply that by 4 you get 2920 shards. Elasticsearch will need resources plus the volume will need to be calculated for holding that many messages. Again this will depend on how many messages you are ingesting, for how long and what your search criteria is for dashboard and saved searches.

You may want to start read here for a better understand what you might need

Also check out this post

Hope that helps

1 Like