Retention usage

New to Graylog Community? READ-ME FIRST Guides
1

does Graylog have the ability to let’s say after 60 days close the index and then after 90 days delete the index? if not is there a suitable way for me to be able to do this? cronjob python script etc…

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Graylog has this ability. It does this using 2 concepts:

  • Index Rotation - where messages are stored, determines when to create a new index
  • Index Retention - how long to keep an index for and what happens when the index is older than the specified limit.

For more details, see Index Model