Is Elasticsearch Rollover Index compatible with Graylog

Graylog Central (peer support)
1

Hello,

We would like to reduce the number of shards our cluster has. We already changed our retention/rotation policy but the number is still too high.

We found the rollover index feature from Elasticsearch (https://www.elastic.co/guide/en/elasticsearch/reference/6.8/indices-rollover-index.html), and we would like to know if we could use it with Graylog and if you have knowledge about the two things working together. We are afraid that the alias used by Elasticsearch won’t work with Graylog.

Thanks for your help

2

if you have configured your retention and rotation for the indices and also changed the number of shards per index Graylog will make the housekeeping of your new created indices and will take care that you only have the configured amount of indices.

New indices will take care of your new shard configuration, old indices will not be adjusted. I’m not sure what exactly your goal is with the rollover in elasticsearch. Maybe you can describe your idea behind that.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.