I guess I should ask Francois, how did you install Graylog 1.0 (package, OVA, etc)?. Based on the location of his conf file "/opt/graylog/graylog.conf", he may not be using the OVA which uses "/opt/graylog/conf/graylog.conf".
Can anyone else confirm if their 1.0 graylog.conf file is missing "rotation_strategy"? Thanks, Tristan On Sat, Mar 7, 2015 at 1:05 PM, Tristan Rhodes <[email protected]> wrote: > I double-checked for the setting you mentioned. However, the Graylog OVA > is missing these rotation settings. There may be other missing settings, > it might be worth finding out why the OVA conf file doesn't match the > default conf file. > > ubuntu@graylog:/opt/graylog/conf$ grep rotation graylog.conf > # Disable message retention on this node, i. e. disable Elasticsearch > index rotation. > ubuntu@graylog:/opt/graylog/conf$ grep rotation_strategy graylog.conf > ubuntu@graylog:/opt/graylog/conf$ > > I created an issue for this: > https://github.com/Graylog2/graylog2-images/issues/47 > > Thanks! > > Tristan > > On Sat, Mar 7, 2015 at 8:38 AM, Kay Röpke <[email protected]> wrote: > >> Look for rotation, not retention. >> >> There's a rotation_strategy entry. Have a look at >> https://github.com/Graylog2/graylog2-server/blob/master/misc/graylog2.conf >> >> Cheers! >> On Mar 7, 2015 4:34 PM, "Tristan Rhodes" <[email protected]> >> wrote: >> >>> I noticed this was missing also. It is possible that the settings are >>> missing by default, but they would work if added manually. (I don't >>> have the right syntax with me). >>> >>> On Friday, March 6, 2015, Francois Franck <[email protected]> wrote: >>> >>>> Hi all, >>>> >>>> I've heard about a time-based retention policy to rotate indices but I >>>> can't find such a policy in *Graylog v1.0*. >>>> Here what my */opt/graylog/graylog.conf* looks like >>>> >>>> ... >>>> elasticsearch_max_docs_per_index = 20000000 >>>> # Disable message retention on this node, i. e. disable Elasticsearch >>>> index rotation. >>>> #no_retention = false >>>> elasticsearch_max_number_of_indices = 20 >>>> # Decide what happens with the oldest indices when the maximum number >>>> of indices is reached. >>>> # The following strategies are availble: >>>> # - delete # Deletes the index completely (Default) >>>> # - close # Closes the index and hides it from the system. Can be >>>> re-opened later. >>>> retention_strategy = delete >>>> ... >>>> >>>> >>>> Did I miss something ? >>>> Can someone tell me how to configure Gralog to keep logs for around 1 >>>> year before rotate ? >>>> Thanks. >>>> >>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "graylog2" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to [email protected]. >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> >>> >>> -- >>> Tristan Rhodes >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "graylog2" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> For more options, visit https://groups.google.com/d/optout. >>> >> -- >> You received this message because you are subscribed to the Google Groups >> "graylog2" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> > > > > -- > Tristan Rhodes > -- Tristan Rhodes -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
