Question about data storage

Graylog Central (peer support)
1

I’ve deployed MongoDB, the data node, and the server on the same Ubuntu server(followed Install Welcome guide, graylog 7.0)—this server has a single 800GB SSD and 12 3TB SAS drives (mounted at /data1, /data2, …, /data12).

I want to configure Firewall-1 session traffic logs (sent via syslog) to be stored in /data1, Firewall-2 session traffic logs to be stored in /data2, and so on. How can I set this up in Graylog7.0?

(I haven’t found options for specifying storage paths in either the index set configuration or the data node configuration file.)

2

Opensearch, which is what powers datanode, doesn’t work that way, all data is treated at the shard level rather than the index level. It is just looking for a space to keep those shards on each node, and so each node only has a single data storage location.

If you want different performance levels, that is approached through the lens of time, not index, through the use of storage tiers, which move older data to slower storage generaly. Data tiering is a feature of the enterprise versions of Graylog.