What is log rotation in Graylog?

[QueenOfCode]

Hello,

I have a question about log rotation in Graylog. What does “rotate the currently active write index” mean in simple/newbie terms? I know that log retention has to do with deleting logs eventually, but why would I need to specify the maximum number of indices for the Index Retention Configuration part?

Thanks!

Update: Let me know if my understanding now is correct (or correct any flaws): I set a specific rotation period / max byte size, and once the index reaches that, a new index is created (?). Then, once the number of these indices hit the max number specified in “Index Retention Configuration,” then whatever action I choose is performed on them (they’re deleted, archived, etc.). Is this correct?

[tmacgbay]

@QueenOfCode

Update: Let me know if my understanding now is correct (or correct any flaws): I set a specific rotation period / max byte size, and once the index reaches that, a new index is created (?). Then, once the number of these indices hit the max number specified in “Index Retention Configuration,” then whatever action I choose is performed on them (they’re deleted, archived, etc.). Is this correct?

Thats how I would have explained it.

[gsmith]

I agree with @tmacgbay

[patrickmann]

Once the max number of indexes is exceeded, GL performs the configured action to bring it back down to max. So usually only 1 index gets deleted / archived / etc. at a time.

[QueenOfCode]

@QueenOfCode

Update: Let me know if my understanding now is correct (or correct any flaws): I set a specific rotation period / max byte size, and once the index reaches that, a new index is created (?). Then, once the number of these indices hit the max number specified in “Index Retention Configuration,” then whatever action I choose is performed on them (they’re deleted, archived, etc.). Is this correct?

Thanks everyone! I’ll label this as the solution for future reference.