Message rotation and compression

Graylog Central (peer support)
1

Hi, I plan to keep 7 day logs, but gray server seams to keep more then 10 days log. So I reduced to 3 days and I can always see all logs.
elasticsearch_max_number_of_indices = 3
rotation_strategy = time
retention_strategy = delete
elasticsearch_max_time_per_index = 1d

is there something wrong with those config lines?
and, can I activate elasticsearch compression? is that supposed to make bug graylog server?

2

hi

Change the retention times from the UI:

System/Indices
then Edit, and you’ll see the correct place to change the settings.

3

ok. I didn’t make search in a most common place. thanks for you answer. It was set to keep 20 indices and to rotate by indice size. Is there some schedule queue to delete useless indice?

4

You may ignore my question: graylog is deleting unless log and I’m getting more disk space.