I was wondering if there was a simple command to type in the graylog interface (query perhaps?) where I can see what the oldest log in all of the indexes are? I want to see how far back I can go back. I realize this could fluctuate depending on log volume and if there are any events going on currently, etc. I am using the OVA and maybe I am missing it, but is there some place that I can check this, or is it simply choosing a source and seeing how far it goes back?
if you did not configured any messages retention in the Graylog OVA it will keep all data until the disk is out of space. You should configure the retention: http://docs.graylog.org/en/2.3/pages/configuration/index_model.html#index-rotation
Now your question - go to ‘System > Indices’ select your index set and you will get a list of indices including the Information for what time period those indices are for.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.