Hi, i have created new index set and changed on it one stream. So in the stream there are no messages between 3/00 am to 8/30am ( time when i changed index set) Where are messages ? or how i can find it in stream ? thx
add one more … i found this messages from 3/00 am to 8/30am in all messages stream, so why they are not display in another stream ?
You changed the index set that stream is using, so you basically “abandoned” the old messages.
See http://docs.graylog.org/en/2.2/pages/configuration/index_model.html for details about the index model.
so can i change index set without losing messages in stream ?
aditional question , how can i change a rotation time ? Default time is at 3.00 am as i understood…
No.
But keep in mind that the messages aren’t “lost” but simply unavailable in the stream, if you’re using a different index set.
Rotation and retention strategies are part of the index set configuration, see System / Indices in your Graylog web interface.
Rotation and retention strategies are part of the index set configuration, see System / Indices in your Graylog web interface.
i mean i have rotation strategy - 1 index per day, so rotation starts at 3:00 am o`clock , where i can change this time to do it may be at 22:00 pm ? There is no this options in System / Indices
The time-based rotation strategy basically says that a index should have a certain period worth of logs, so if you configure it to have 1 day worth of logs (P1d) and the index is created at 5pm, the next rotation will occur on 5pm the following day.
If you want to rotate indices at 22:00 every day, you could manually rotate indices for this index set once at this time via the web interface or the Graylog REST API.
1 Like
hi, again , i have made rotation at 22.00 , but graylog did it again at 3.00 . This time is hardcoded in graylog?
@jochen any thoughts ?