Hello i have this rotation strategy:
Index Time
Rotation period:
P14D (14 days, 14 days)
Index retention strategy:
Delete
Max number of indices:
27
yesterday new second index graylog_1 created by server .,
but 14 days have not passed yet, why was the second new index created?
Are you sure the old index not 14 days old?
The highlighted part shows only the first (40 years before…) and the last event in the indices. So if you send a message with future date, it can mystify you. And also, It can caused by a mistake by you. I think you should find the exact reason if the system does the same every time, eg for a month without any retention editing. I have never seen something similar at the last 3 years, so Based on that, I don’t think it is a bug.
I suggest check it every 4-5 days, and if you see the graylog starts the rotation every 11 days (not 14), you should check the original cause the problem. Until that I think you waste your time.
You can also check the graylog’s log on the web UI, for check the exact rotation time. (System - overview - system messages)
yes i am sure because i started graylog server 12 days ago and graylog_0 was first index. after few hours i changed rotation period and index retenation strategy , i think new configuration about rotation period and retenation strategy will work from graylog_1 index .
this is messages :
he @Justmfree
the strategy is used as soon as you change it.
As @macko003 already written you have future based messages in your indices and the timestamp is what counts for the rotation.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.