Hi, I plan to keep 7 day logs, but gray server seams to keep more then 10 days log. So I reduced to 3 days and I can always see all logs.
elasticsearch_max_number_of_indices = 3
rotation_strategy = time
retention_strategy = delete
elasticsearch_max_time_per_index = 1d
is there something wrong with those config lines?
and, can I activate elasticsearch compression? is that supposed to make bug graylog server?