Indices Setting in Graylog2


(Merces) #1

Hello guys,
I want to ask you how to change Max Number of Indices in Graylog2.
The default is 20. I have edited and change it to be 45.
After that, i did Recalculates index ranges. But, when i visited indices page, Default index set 20 indices, 389,839,911 documents, 278.2GB.
Why is it still 20 indices ? Do i miss something ?

And then, i have 250 GB logs a day processed by Graylog2 and ES. And i see in Default indices this statement Elasticsearch cluster is green. Shards: 200 active, 0 initializing, 0 relocating, 0 unassigned
But my shard in Default index is Shards 4 and replicas 0. Should i change shards to be 200 ?
How do i know what value should i put in that ?

elasticsearch_shards = 1
elasticsearch_replicas = 0

Above is my config in /etc/graylog/server/server.conf
Do i need to change Default Index shards to be 1 ?

Thank you for your time and help guys.


(Merces) #2

Ahhh when i did Rotate active write index, indices value incremented automatically to be 21. I think the settings is work correctly.
But i really want to know about these

Index prefix:
graylog
Shards: 4
Replicas: 0

My config elasticsearch_shards and replicas in server.conf

elasticsearch_shards = 1
elasticsearch_replicas = 0

Should i change Shards to be 1 in Indices page ?


(Jan Doberstein) #3

he @merceskoba

did you read the ATTENTION Comment above the this settings in the server.conf?


(Merces) #4

I think the value is stored in db not .log anymore


(Jan Doberstein) #5

yes that is right. So you can write whatever you like into the configuration file - it counts what you find in System > indices in the Graylog UI.


(system) #6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.