# Where are messages after changing index set

**URL:** <https://community.graylog.org/t/where-are-messages-after-changing-index-set/785>\
**Category:** Graylog Central (peer support)\
**Created:** [April 12, 2017, 5:45am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785 "2017-04-12T05:45:32Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidoff](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@davidoff](https://community.graylog.org/u/davidoff)\
**Post date:** [April 12, 2017, 5:45am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785/1 "2017-04-12T05:45:32Z")

</div>

Hi, i have created new index set and changed on it one stream. So in the stream there are no messages between 3/00 am to 8/30am ( time when i changed index set) Where are messages ? or how i can find it in stream ? thx

---

<div class="post-metadata">

**Author:** ![davidoff](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@davidoff](https://community.graylog.org/u/davidoff)\
**Post date:** [April 12, 2017, 6:10am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785/2 "2017-04-12T06:10:28Z")

</div>

add one more … i found this messages from 3/00 am to 8/30am in all messages stream, so why they are not display in another stream ?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 12, 2017, 6:23am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785/3 "2017-04-12T06:23:20Z")

</div>

You changed the index set that stream is using, so you basically “abandoned” the old messages.

See [http://docs.graylog.org/en/2.2/pages/configuration/index\_model.html](http://docs.graylog.org/en/2.2/pages/configuration/index_model.html) for details about the index model.

---

<div class="post-metadata">

**Author:** ![davidoff](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@davidoff](https://community.graylog.org/u/davidoff)\
**Post date:** [April 12, 2017, 6:28am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785/4 "2017-04-12T06:28:16Z")

</div>

so can i change index set without losing messages in stream ?

aditional question , how can i change a rotation time ? Default time is at 3.00 am as i understood…

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 12, 2017, 6:32am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785/5 "2017-04-12T06:32:47Z")

</div>

> [@davidoff](#):
>
> so can i change index set without losing messages in stream ?

No.

But keep in mind that the messages aren’t “lost” but simply unavailable in the stream, if you’re using a different index set.

> [@davidoff](#):
>
> how can i change a rotation time ?

Rotation and retention strategies are part of the index set configuration, see System / Indices in your Graylog web interface.

---

<div class="post-metadata">

**Author:** ![davidoff](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@davidoff](https://community.graylog.org/u/davidoff)\
**Post date:** [April 12, 2017, 6:46am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785/6 "2017-04-12T06:46:08Z")

</div>

> Rotation and retention strategies are part of the index set configuration, see System / Indices in your Graylog web interface.

i mean i have rotation strategy - 1 index per day, so rotation starts at 3:00 am o`clock , where i can change this time to do it may be at 22:00 pm ? There is no this options in System / Indices

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 12, 2017, 7:54am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785/7 "2017-04-12T07:54:54Z")

</div>

The time-based rotation strategy basically says that a index should have a certain period worth of logs, so if you configure it to have 1 day worth of logs (`P1d`) and the index is created at 5pm, the next rotation will occur on 5pm the following day.

If you want to rotate indices at 22:00 every day, you could manually rotate indices for this index set once at this time via the web interface or the Graylog REST API.

---

<div class="post-metadata">

**Author:** ![davidoff](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@davidoff](https://community.graylog.org/u/davidoff)\
**Post date:** [April 13, 2017, 5:10am UTC](https://community.graylog.org/t/where-are-messages-after-changing-index-set/785/8 "2017-04-13T05:10:52Z")

</div>

hi, again , i have made rotation at 22.00 , but graylog did it again at 3.00 . This time is hardcoded in graylog?  
@jochen any thoughts ?
