What is log rotation in Graylog?


I have a question about log rotation in Graylog. What does “rotate the currently active write index” mean in simple/newbie terms? I know that log retention has to do with deleting logs eventually, but why would I need to specify the maximum number of indices for the Index Retention Configuration part?


Update: Let me know if my understanding now is correct (or correct any flaws): I set a specific rotation period / max byte size, and once the index reaches that, a new index is created (?). Then, once the number of these indices hit the max number specified in “Index Retention Configuration,” then whatever action I choose is performed on them (they’re deleted, archived, etc.). Is this correct?

Thats how I would have explained it. :smiley:

1 Like

I agree with @tmacgbay

1 Like

Once the max number of indexes is exceeded, GL performs the configured action to bring it back down to max. So usually only 1 index gets deleted / archived / etc. at a time.

1 Like

Thanks everyone! I’ll label this as the solution for future reference.


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.