Hello,
in May I started changing my index retention strategy. From the beginning I wanted to use 200GB for logging. I made a mistake because of a misunderstanding and set “Index Retention Configuration” to “delete index”. Max Number of indices=20. Max Index Size is 200GB.
I recognized, that the next index was growing and growing and then I recognized my mistake.
Then a few weeks ago I changed the Graylog Default Index set “Index Retention Configuration” to “delete index”. Max Number of indices=20. Max Index Size is 10GB.
I thought, that the system would cycle the index set automatically, so that I have a maximum of 200GB Logdata. But supposedly, it is not working.
What do I have to do? How can I troubleshoot this, where do I need to look? Is manual action necessary?
Edit:
Another question: How do I know, which one of these indices is the oldest one? I have no clue:
Best Regards
Sebastian