Good day; the comments in the example graylog2 server configuration file currently read as follows:
# Decide what happens with the oldest indices when the maximum number of indices is reached. # The following strategies are availble: # - delete # Deletes the index completely (Default) # - close # Closes the index and hides it from the system. Can be re-opened later. retention_strategy = close I am using the setting for retention_strategy as shown above. My question is about the comment 'can be re-opened later': after closing an old index, I now want to search through the messages in it with Graylog. When I tell elasticsearch to re-open the index I want to search, the index for a short interval becomes live in Graylog (the message count on the Streams page includes the message of the re-opened index) but gets closed by Graylog automatically a moment later, making it again unavailable for search. Is this intended behaviour, meaning that I am supposed to increase the maximum number of allowed indices to accommodate the re-opened indices, then reload the server config/restart the server and THEN be able to search through the old indices (meaning that I have to perform the steps in reverse to get them offline again)? Or is this unintended and should I open an issue about it, because this is obviously a rather tedious/inconvenient process that can be improved? I haven't seen any issues that address this problem in this form. Best regards, J -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
