I have a question about log rotation in Graylog. What does “rotate the currently active write index” mean in simple/newbie terms? I know that log retention has to do with deleting logs eventually, but why would I need to specify the maximum number of indices for the Index Retention Configuration part?
Update: Let me know if my understanding now is correct (or correct any flaws): I set a specific rotation period / max byte size, and once the index reaches that, a new index is created (?). Then, once the number of these indices hit the max number specified in “Index Retention Configuration,” then whatever action I choose is performed on them (they’re deleted, archived, etc.). Is this correct?