Handle "System messages" in the "Overview" section

The Graylog GUI shows two years history of “System Messages” (“System / Overview” → “Overview” → “System message” section.

My environment:

  • Ubuntu 20.04.4 LTS
  • Graylog-server 4.2.8
  • MongoDB 4.0.28
  • Elasticsearch 6.8.23

Steps done so far:
I reduced the “Indices & Index Sets” retention and did delete all, but the latest / Index Sets.
The Graylog GUI still lists all (2 years) “System messages”.



  • Is it correct, that the “System messages” are stored in the MongoDB?
  • How can I delete the ?“System messages”?

Thanks and regards


MongoDb hold metadata.

I believe its stored in elasticsearch in binary files, but I’m not 100% sure


I was looking into this, If you goto System/Node ->> API Browser.
Under System/Messages : Internal Graylog messages

You can see you System Messages.
Request URL


Here is the Response header. Maybe you can do something with that.


1 Like

System messages are stored in Mongo DB in collection system_messages.
We already have an issue to make an improvement to this:


Thanks gsmith and pattrickmann,

@gsmith: I’m able to query the logs. When I got it right, there are more than 360.000 log entries.

@patrickmann: The git issue for improvement contains the “command” needed for my purpose, but some additional steps have been needed for me to take benefit:

Install mongosh
Start mongosh and select the graylog db:

show dbs
use graylog

Enter the sequence to delete system messages older than one month:

            $lt: new Date(new Date().setMonth(new Date().getMonth()-1))

Result:"{ acknowledged: true, deletedCount: 362963 }"

(The system messages older than one month have been deleted)

Afterwards, I did release unneeded disk space:

print('Compacting: '+collectionName);
db.runCommand({compact: collectionName});

Thanks for your fast and helpful support!


1 Like


Good find :+1: This also had me puzzled.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.