Where are messages after changing index set


(Artem Davydov) #1

Hi, i have created new index set and changed on it one stream. So in the stream there are no messages between 3/00 am to 8/30am ( time when i changed index set) Where are messages ? or how i can find it in stream ? thx


(Artem Davydov) #2

add one more … i found this messages from 3/00 am to 8/30am in all messages stream, so why they are not display in another stream ?


(Jochen) #3

You changed the index set that stream is using, so you basically “abandoned” the old messages.

See http://docs.graylog.org/en/2.2/pages/configuration/index_model.html for details about the index model.


(Artem Davydov) #4

so can i change index set without losing messages in stream ?

aditional question , how can i change a rotation time ? Default time is at 3.00 am as i understood…


(Jochen) #5

No.

But keep in mind that the messages aren’t “lost” but simply unavailable in the stream, if you’re using a different index set.

Rotation and retention strategies are part of the index set configuration, see System / Indices in your Graylog web interface.


(Artem Davydov) #6

Rotation and retention strategies are part of the index set configuration, see System / Indices in your Graylog web interface.

i mean i have rotation strategy - 1 index per day, so rotation starts at 3:00 am o`clock , where i can change this time to do it may be at 22:00 pm ? There is no this options in System / Indices


(Jochen) #7

The time-based rotation strategy basically says that a index should have a certain period worth of logs, so if you configure it to have 1 day worth of logs (P1d) and the index is created at 5pm, the next rotation will occur on 5pm the following day.

If you want to rotate indices at 22:00 every day, you could manually rotate indices for this index set once at this time via the web interface or the Graylog REST API.


(Artem Davydov) #8

hi, again , i have made rotation at 22.00 , but graylog did it again at 3.00 . This time is hardcoded in graylog?
@jochen any thoughts ?