# Retention strategy change **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [May 3, 2021, 3:46pm UTC](https://community.graylog.org/t/retention-strategy-change/19712 "2021-05-03T15:46:05Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![sgarciam](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/sgarciam/32/285_2.png) [@sgarciam](https://community.graylog.org/u/sgarciam)\ **Post date:** [May 3, 2021, 3:46pm UTC](https://community.graylog.org/t/retention-strategy-change/19712/1 "2021-05-03T15:46:05Z")
Hey all, question on retention changes. At this point I’m not sure if what im seeing is the correct behaviour or not. GL Version 4.0.6+40b7be5, codename Noir So take this index set: Rotation: time Period: P1D Srategy: close Max indeces: 180 That is working all fine and good but now I made a change to it to the following settings: Rotation: time Period: P1D Srategy: delete Max indeces: 274 The problem is that the original strategy ran for long enought that it racked up 368 indeces (181 of which are now open, 187 of which are closed). Now we a higher max than before for opened indeces, but it has more indeces total than its max. Should it automatically delete the closed indeces past 274 or, becuse those are closed, they are not being looked at and would need to be manually deleted? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 4, 2021, 1:50am UTC](https://community.graylog.org/t/retention-strategy-change/19712/2 "2021-05-04T01:50:17Z")
Hello, Have you tried to Recalculate index ranges or Rotate active write index? ---
**Author:** ![sgarciam](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/sgarciam/32/285_2.png) [@sgarciam](https://community.graylog.org/u/sgarciam)\ **Post date:** [May 4, 2021, 1:15pm UTC](https://community.graylog.org/t/retention-strategy-change/19712/3 "2021-05-04T13:15:53Z")
@gsmith Manually I have not but as I look at that index zet this morning it did auto recalculate and rotate 13 hours ago. What prompted me to make this change was the following message `Elasticsearch nodes disk usage above low watermark` `There are Elasticsearch nodes in the cluster running out of disk space, their disk usage is above the low watermark. For this reason Elasticsearch will not allocate new shards to the affected nodes` Im leaning towards there being multiple factors to preventing retention strategy from activating: space, strategy change, number of indeces vs max set size. I think i will start manually deleting the older indeces to get to a point where size goes below the treshhold and see how it behaves after that ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 5, 2021, 12:50am UTC](https://community.graylog.org/t/retention-strategy-change/19712/4 "2021-05-05T00:50:07Z")
@sgarciam > [@sgarciam](#): > > I think i will start manually deleting the older indeces to get to a point where size goes below the treshhold and see how it behaves after that If you manually delete Indices make sure you do it through the Web UI. ---
**Author:** ![sgarciam](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/sgarciam/32/285_2.png) [@sgarciam](https://community.graylog.org/u/sgarciam)\ **Post date:** [May 5, 2021, 1:52pm UTC](https://community.graylog.org/t/retention-strategy-change/19712/5 "2021-05-05T13:52:27Z")
@gsmith Found yet another factor that was preventing things fromn running as they should. Storage running low coincided quite nicely with the max number of shards allowed going over so it was complaining about both. I’ve upped the max numbers of shards allowed (not ideal but needed to get things rotated) and everything rotated as it should after a graylog service restart. > [@gsmith](#): > > If you manually delete Indices make sure you do it through the Web UI. Well… too late for that. did it through curl calls to the elasticsearch node. Not exeedingly worried about that (unless I should be). However, I do have a second index set with exactly the same details as stated in the original post: Lots of closed indeces, strategy changed to delete, closed indeces still there above the increased max indeces. Havent touched that one just yet besides it finally rotating by itself after increasing the number of shards allowed mentioned above. What I would really like to know is if the retention strategy considers closed indeces for its calculation. If it doesnt it would explain it not removing the old indeces but i dont know its exact behaviour in this situation. If I have to manually delete indeces, are ther curl calls to the graylog server that I could use to do that? I would really nike not to go through the web ui to delete 200+ indeces. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 6, 2021, 1:07am UTC](https://community.graylog.org/t/retention-strategy-change/19712/6 "2021-05-06T01:07:52Z")
Hello, > [@sgarciam](#): > > I would really nike not to go through the web ui to delete 200+ indices. Well, yes there is, but it would probably take you just as long Lists Indices: `curl -XGET http://localhost:9200/_cat/shards` Delete Indices `curl -XDELETE 'http://localhost:9200/name_of_index/'` Graylog Server Service might need to be restarted. > [@sgarciam](#): > > What I would really like to know is if the retention strategy considers closed indeces for its calculation It probably doesn’t consider close indices, so you may need to open them up and recalculate the indexes again. I personally haven’t done that, but you could give it a try. ---
**Author:** ![sgarciam](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/sgarciam/32/285_2.png) [@sgarciam](https://community.graylog.org/u/sgarciam)\ **Post date:** [May 6, 2021, 12:53pm UTC](https://community.graylog.org/t/retention-strategy-change/19712/7 "2021-05-06T12:53:55Z")
@gsmith > [@gsmith](#): > > Well, yes there is, but it would probably take you just as long > Lists Indices: > > `curl -XGET http://localhost:9200/_cat/shards` Ah ok. Was afraid I had done it some other way that was not a good idea but that is how I did it. took no time at all. And yes the Graylo Server Service had to be restarted. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [May 20, 2021, 12:54pm UTC](https://community.graylog.org/t/retention-strategy-change/19712/8 "2021-05-20T12:54:02Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.