Hi all, yesterday I observed in my Graylog Dashboard, that I only have messages available, that are max. 7 days old… It looks like that: [image] Because I have different indices, the main ones based on size, I started looking what could be the issue. This is the default index set, at which a fe…

I think I should add the following, maybe it is important here: In the past, I set another Index as the “Default index set”, this was because of a thought how to route data to different destinations based on the customer to keep the data seperate (to be able to set permissions accordingly and also …

[image] seroal: It is also not possible to change or delete this “All messages” stream Maybe this might help with your question. [image] Is it possible to edit the default stream (all messages) via the rest api? Graylog Central (peer support) No, that’s not possibl…

Is it possible to edit the default stream (all messages) via the rest api? ut it’s possible to add outputs to the “All messages” stream via the Graylog REST API. You can also manage outputs in the Graylog web inte I mean, that answer is especially about the Rest API. So I don´t know, what wou…

Now I set back the default index setting to the standard “default index set”. I will monitor the situation… But anyways, would be interesting to get to know from somebody, how the system behaves like it does.

Hi there. Today I took another look at my messages. I went into my stream, that sends messages into the index using index rotation by index size. Despite of that, I still have only 7 days of messages. The 7 days setting is only applied to the default index set. Is the setting somehow inherited to…

Hello, [image] seroal: that sends messages into the index using index rotation by index size. Have you tried to increase the size of that index (10GB) to see if you can have more then 7 Days? Like make it 12 GB etc… That index created by Size (i.e. 10GB ) Did you test to see if there are…

Hi! [image] gsmith: [image] seroal: that sends messages into the index using index rotation by index size. Have you tried to increase the size of that index (10GB) to see if you can have more then 7 Days? Like make it 12 GB etc… That index created by Size (i.e. 10GB ) Did you test to s…

Hi there. Today I took another look into the system. What should I say. For some reason, it is now working as expected again. Have a look at the data available since now 29.03.21. Thats strange to me. I can only imagine, that this is caused by changing the default index set. And then because of some…

@seroal Sorry to here that this is still a problem. What changes and/or configuration have you done different this time compared to last time? NOTE: “The definition of insanity is doing the same thing over and over again and expecting different results.”

Only message from the last 7 days are beeing displayed / Where are the old messages? Index/Streams Question

Graylog Central (peer support)

seroal March 29, 2021, 6:30am 4

I mean, that answer is especially about the Rest API. So I don´t know, what would be possible outside API to do with the all messages Stream.

But that was also a question to provide with the main question, how it comes, that I only have data for the last 7 days…

Topic		Replies	Views
Still issues with Graylog Indices and the applied retention policy Graylog Central (peer support)	1	538	April 30, 2021
How to change the "All Messages" Stream to use different Index? Graylog Central (peer support)	8	1697	June 15, 2022
Default indice for all message stream Graylog Central (peer support)	0	918	October 18, 2019
Where are messages after changing index set Graylog Central (peer support)	7	1875	April 13, 2017
Graylog v5, messages missing Graylog Central (peer support)	3	37	August 15, 2024

Only message from the last 7 days are beeing displayed / Where are the old messages? Index/Streams Question

Related topics