Assume we have time based index of range 0-53. The rotation is P7D, the retention is 53 (weeks)
What happens when Graylog creates index 54? Is graylog_0 be deleted, not matter what date range is in there?
We run into a scenario where we had to reprocess old logfiles. The logs are somewhere in the middle of our index range, lets say at 25.
What happens with index graylog_25 ?
Graylog Version: 3.0.2
Graylog creates new index based on rotation policy (P7D) and deletes oldest index by number, to keep max count 53.
Here is one of my indices, as example:
Index rotation strategy: Index Time
Rotation period: P1W (7d, 7 days)
Index retention strategy: Delete
Max number of indices: 5
5 indices with a total of 320,247 messages under management, current write-active index is router_6
router_6 active write index Contains messages up to a few seconds ago (10.7MB / 41,195 messages)
router_5 Contains messages from 11 days ago up to 4 days ago (7.8MB / 63,171 messages)
router_4 Contains messages from 18 days ago up to 11 days ago (7.8MB / 63,337 messages)
router_3 Contains messages from 25 days ago up to 18 days ago (9.2MB / 74,687 messages)
router_2 Contains messages from a month ago up to 25 days ago (9.5MB / 77,857 messages)
So its working just by number, not by log date
Thank you
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
