Assume we have time based index of range 0-53. The rotation is P7D, the retention is 53 (weeks)
What happens when Graylog creates index 54? Is graylog_0 be deleted, not matter what date range is in there?
We run into a scenario where we had to reprocess old logfiles. The logs are somewhere in the middle of our index range, lets say at 25.
What happens with index graylog_25 ?
Graylog Version: 3.0.2
Graylog creates new index based on rotation policy (P7D) and deletes oldest index by number, to keep max count 53.
Here is one of my indices, as example:
Index rotation strategy: Index Time
Rotation period: P1W (7d, 7 days)
Index retention strategy: Delete
Max number of indices: 5
5 indices with a total of 320,247 messages under management, current write-active index is router_6
router_6 active write index Contains messages up to a few seconds ago (10.7MB / 41,195 messages)
router_5 Contains messages from 11 days ago up to 4 days ago (7.8MB / 63,171 messages)
router_4 Contains messages from 18 days ago up to 11 days ago (7.8MB / 63,337 messages)
router_3 Contains messages from 25 days ago up to 18 days ago (9.2MB / 74,687 messages)
router_2 Contains messages from a month ago up to 25 days ago (9.5MB / 77,857 messages)
So its working just by number, not by log date
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.