Index Set Tiering question, some how I lost data

Graylog Central (peer support)
1

1. Describe your incident:

I had my Data Tiering set to Min Days 30 and Max days in storage to 365. Few months back I change these to Min 365 and Max 1825, since I have lots of nvme storage and can easily hold multiple years and for the application which is logging to that index, having multiple years is very useful.

Today I then noticed the oldest log entry/document I have currently is 2025-11-10, not sure when this issue happened, but I’m a tad bit confused. Did it do some sort of prune when I upped the values?

I have another index that still Min 30 and Max 365, and it still has data from January 2025 as expected. Don’t actually care that much about this index though. just a little test application.

2. Describe your environment:

3. What steps have you already taken to try and solve the problem?

None so far, trying to workout if my setting are correct, as I don’t believe this should have happened.

4. How can the community help?
I would like to know how this might of happened, and if I’ve done about my index set settings wrong. I’m pretty sure I’ve not done anything wrong here.

It’s using the default index set, but this Graylog instance is just for logging a single application, so splitting it up doesn’t add anything.

2

Do you remember how many indices were in that set before, is there really only the active write index currently and all the old ones are gone, very strange.

3

I’ve only ever seen 1, but I think it was graylog_7 when I adjusted the Tiering.

I assume I’ve set my setting correctly?

4

I looked back in the system messages, and I can see it doing what it did on the 10th of November

image
image1594×190 22.6 KB

no mention of deleting graylog_7

5

Ya that system message was it rolling over.

If you do a search for everything in that index, what date range do you see of the messages, is it all nice and together like this, or are there some random messages that are really old showing up (incorrect timestamps etc)

image
image2936×830 202 KB

So in your case

_index:graylog_7

6

Nothing at all for _7

image
image1256×389 18.4 KB

_8 shows as expected

image
image1252×394 20.1 KB

7

Could I ask, how many days of data are you are looking to store?

8

As much as possible really. hence why I upped it to 5 years max