I’m wondering if it’s possible to query data from closed indices?
Am i able to restore it somehow if needed?
you can always reopen indices temporarily, perform search and close them
1 Like
how exactly can i do that?
go to System > Indices, choose Default index set, list of indices will appear, choose closed index and there should be “Repoen index” option, you’ll have to figure out which index you should open time range you want to search in
1 Like
OK, thats nice thank you.
Just another question: For instance if I have configured 20 indices with the retention delete, will the search go trough all the 20 indices?
the search will use all indices it needs to search in, based on the selected time period.
because graylog knows (by min/max) query what timerange is in what index
yes, in that setup if it’s not deleted it’s open and search will be performed in all indices
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.