I’ve been running Graylog 3.0 (the appliance version) for sometime but have been forced to increase the filesystem containing the default index file a few times.
I’ve set limits on the size of the default index file using both size and on another occassion the number of entries to no avail, i.e. the index files grows beyond the limits I’ve set.
I find one way to briefly clear some space is to run the following command:
but this is not a good long term solution.
curl -XPUT -H “Content-Type: application/json” http://localhost:9200/_all/_settings -d ‘{“index.blocks.read_only_allow_delete”: null}’{“acknowledged”:true}
It is likely that this index file limit is not enforced because I’m running an appliance version of Graylog ?
Use google again, it won’t give you more storage. It’s allow you to put back the elasticseach to writeable after you achieve and restore the 95% disk usage.
The limits what you set is only for ON index, and only for the future. So it won’t resize the old indices. If you set size limit, it’s not the real size, and if you set message count, you can’t calculate with fix size.
Try to understand the index set’s settings’ again, to be it clear for you.
Hi, just to clarify I am not attempting to reduce the index size or add more storage. I was forced to increase the storage size and set the index size “only” for the future expansion.
Even so, graylog is not able to rotate the logs once the limit is reached using values much larger than the current settings (both in size and number of index entries).
I should also mention that I’m not using the Enterprise version of Graylog but the free version via an appliance. Is this an issue ?
