My environment is one node with Elasticsearch 6.8.2, MongoDB v4.0.11, and Graylog Server 3.0.2+1686930.
I’m using the “default Index set”, (Shards:4, Index rotation strategy: Index Time, Index retention strategy: Delete, Max number of indices:30)
I have a stream called “User Added”. This notifies me every time a user/s is added to the Domain.
What I would like to do is keep these messages from the stream “User Added” for a Year and not be added to the Index retention strategy 30 days. What I would like to happen is when I do a search for “User Added” they would come up in the Search from the whole year.How would I go about doing this?
- Do I need to create a separate Index set and can I set the location where the messages are stored?
- Can I separate one shard for the stream “User Added”?
So, to sum it up, I would like a Stream to retain a year worth of messages and I need the 30-Day retention for the rest of the messages and still be able to do an index search on User Added , if that makes sense. Just not sure how I can have two different Retention ,one for all messsages and one for just a stream.
Any Advice would be appreciated. Thank you