Retention time for different volumes


(theresa) #1

hello community,

i was wondering if it’s possible to have the data retention on separate volumes.
let’s say the first 30 days that should be available swiftly should be stored on fast SSD disks and the remaining 60 days can be stored on a NAS volume (simply because it’s cheaper).
i’m not sure if this is possible at all?

i’m in the midst of setting up a brand-new graylog environment (3.0) and have the requirement that the old data from the previous graylog instance (elasticsearch 2.x) would be available as well. it elasticsearch 6.x downward compatible with elasticsearch 2.x ?

I apologize in advance if this is not the right place to ask this…


(Jan Doberstein) #2

you want to check in for hot-warm architecture and search this community about this topic.

For the data compatibility question: http://docs.graylog.org/en/3.0/pages/upgrade/elasticsearch-6.html


(theresa) #3

Excellent as always, thank you Jan :slight_smile:


(theresa) #4

This is looking cool, however I’m wondering if it makes sense (and actually can be done) running both a warm and a hot node on the same server.

Does anyone have any experience in running them combined?
This way, I’d have 3 servers instead of 6 servers (both running elasticsearch warm and hot nodes).


(Jan Doberstein) #5

depending on the available RAM and CPU that might be possible - but you need to know what you do, how you configure both instances of Elasticsearch on the same systems. That is a non-trivial task. Also for tuning an debugging I would recommend to have that separated to different servers.