I am running Graylog version : 2.2.3
My current config is set to rotate the active write index each day, this works as intended.
My current config is set to delete old indices, with a maximum number of 2 indices. However there are now 18 indices, and old ones aren’t being deleted. I have tried restarting GL and rotating and recalculating the indices.
Regards
G
What’s the exact configuration of your index set(s)?
What’s in the logs of your Graylog and Elasticsearch nodes?
Ok, so I resolved the issue.
Firstly my Elasticsearch cluster health was red. So I resolved this by following the guide in this link: http://blog.florian-hopf.de/2015/02/fixing-elasticsearch-allocation-issues.html
Once I resolved this issue I went back to look at the retention strategy issues, but to my surprise the other indices were gone and there were only two as I expected.
Cheers,
G
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
