Hi everyone, I’m using Graylog on Debian, and I have a total of 2GB of gc.log in my /var/log/elasticsearch folder. I know I can remove them manually, but I’d rather limit them. Is this possible ?
Like having 3 files max ?
Thanks for your feedback.
Hi @hebval
you might be a fan of “logrotate” after you implemented it 
1 Like
Index retention is set on the System/Indices page. Go to System/Indices and click the Edit button for your index. I’m assuming you’re using the default index, but go to whichever index you want to limit.
Set your index rotation to the Index Time rotation strategy. Set the period to P1D (Period - 1 day).
Then set the retention strategy to Delete index and the Max indices to 3. Then you’ll always have three days worth of logs and it will automatically delete the older index as the new ones is created. When you make these changes, be sure to manually rotate the index in question, so the settings will take effect immediately.
If you had a licensed version, you could choose to archive rather than delete. Don’t know if this would interest you, but thought I would mention it just in case.
Hello,
Adding on to @joe.gross @ihe
The gc.log file should be kept smaller. Usually there are several rotations of this file managed by log4j.
Along with this I believe
gc_warning_threshold = 1s
The threshold of the garbage collection runs. If GC runs take longer than this threshold, a system notification will be generated to warn the administrator about possible problems with the system. Default is 1 second.
The configurations should be in this file log4j2.xml
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.