Max_result_window on GrayLog7

Graylog Central (peer support)
1

Hello,

I’m new to Graylog, and I did a test installation using Docker.
I created a raw TCP input and imported a log file of several gigabytes. Now I’d like to scroll through these logs, but I can only view 66 pages.
I’d like to increase the value of index.max_result_window, but I can’t.
I tried this curl
curl -u admin:value of GRAYLOG_PASSWORD_SECRET -XPUT -H ‘Content-Type: application/json’ -d ‘{“index”: {“max_result_window”: 10000000 }}’ ‘https://127.0.0.1:9200/graylog_0/_settings’ -k, but it says authentication fails.
I tried creating a user on OpenSearch by editing the internal_users.yml file and adding a new user, but the result doesn’t change.
I ask you the correct way to increase this value, thanks in advance

2

Hey @cargreg,

Out of interest, why do you need to scroll through 66 pages as apposed to narrowing the search window or query for a more accurate set of results?

3

My collague @konrad recently published a blog post about this problem, and a solution that the Graylog engineering team came up with: Sliding Through the Log-Time Space

4

when you upload a huge log file with a raw input without using an extractor or a pipeline script,all logs have the some date,so in some case i need to scrool more than 66 pages

5

the ticket could be consider closed i solved by myself