Reduce size of daily logs from different devices

Graylog Central (peer support)
4

Hello there

Liscence usage relates to data saved to Elasticsearch only - not data received to Graylog. You can therefore use Graylog to enrich your data, or in this case filter your data, so less gets saved to Elastic.

With this in mind, some typical ways to shave data usage:

  1. make sure “store full_message” is not enabled on any input

  2. drop any messages you don’t actually need using a pipeline rule. For example, you might drop any message with [DEBUG] tag to prevent high verbosity hitting your ingestion limit.

  3. drop any fields you don’t need using a pipeline rule. For example, you might be writing long stack traces to a field. If you drop the field, the message will use less ES storage.

1 Like