Hi I installed from RPM, and it is there:
# Graylog will use multiple indices to store documents in. You can configured the strategy it uses to determine # when to rotate the currently active write index. # It supports multiple rotation strategies: # - "count" of messages per index, use elasticsearch_max_docs_per_index below to configure # - "size" per index, use elasticsearch_max_size_per_index below to configure # valid values are "count", "size" and "time", default is "count" rotation_strategy = count Op zaterdag 7 maart 2015 21:09:58 UTC+1 schreef Tristan Rhodes: > > I guess I should ask Francois, how did you install Graylog 1.0 (package, > OVA, etc)?. Based on the location of his conf file > "/opt/graylog/graylog.conf", he may not be using the OVA which uses > "/opt/graylog/conf/graylog.conf". > > Can anyone else confirm if their 1.0 graylog.conf file is missing > "rotation_strategy"? > > Thanks, > > Tristan > > On Sat, Mar 7, 2015 at 1:05 PM, Tristan Rhodes <[email protected] > <javascript:>> wrote: > >> I double-checked for the setting you mentioned. However, the Graylog OVA >> is missing these rotation settings. There may be other missing settings, >> it might be worth finding out why the OVA conf file doesn't match the >> default conf file. >> >> ubuntu@graylog:/opt/graylog/conf$ grep rotation graylog.conf >> # Disable message retention on this node, i. e. disable Elasticsearch >> index rotation. >> ubuntu@graylog:/opt/graylog/conf$ grep rotation_strategy graylog.conf >> ubuntu@graylog:/opt/graylog/conf$ >> >> I created an issue for this: >> https://github.com/Graylog2/graylog2-images/issues/47 >> >> Thanks! >> >> Tristan >> >> On Sat, Mar 7, 2015 at 8:38 AM, Kay Röpke <[email protected] <javascript:> >> > wrote: >> >>> Look for rotation, not retention. >>> >>> There's a rotation_strategy entry. Have a look at >>> https://github.com/Graylog2/graylog2-server/blob/master/misc/graylog2.conf >>> >>> Cheers! >>> On Mar 7, 2015 4:34 PM, "Tristan Rhodes" <[email protected] >>> <javascript:>> wrote: >>> >>>> I noticed this was missing also. It is possible that the settings are >>>> missing by default, but they would work if added manually. (I don't >>>> have the right syntax with me). >>>> >>>> On Friday, March 6, 2015, Francois Franck <[email protected] >>>> <javascript:>> wrote: >>>> >>>>> Hi all, >>>>> >>>>> I've heard about a time-based retention policy to rotate indices but I >>>>> can't find such a policy in *Graylog v1.0*. >>>>> Here what my */opt/graylog/graylog.conf* looks like >>>>> >>>>> ... >>>>> elasticsearch_max_docs_per_index = 20000000 >>>>> # Disable message retention on this node, i. e. disable Elasticsearch >>>>> index rotation. >>>>> #no_retention = false >>>>> elasticsearch_max_number_of_indices = 20 >>>>> # Decide what happens with the oldest indices when the maximum number >>>>> of indices is reached. >>>>> # The following strategies are availble: >>>>> # - delete # Deletes the index completely (Default) >>>>> # - close # Closes the index and hides it from the system. Can be >>>>> re-opened later. >>>>> retention_strategy = delete >>>>> ... >>>>> >>>>> >>>>> Did I miss something ? >>>>> Can someone tell me how to configure Gralog to keep logs for around 1 >>>>> year before rotate ? >>>>> Thanks. >>>>> >>>>> >>>>> -- >>>>> You received this message because you are subscribed to the Google >>>>> Groups "graylog2" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send >>>>> an email to [email protected]. >>>>> For more options, visit https://groups.google.com/d/optout. >>>>> >>>> >>>> >>>> -- >>>> Tristan Rhodes >>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "graylog2" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to [email protected] <javascript:>. >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "graylog2" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected] <javascript:>. >>> For more options, visit https://groups.google.com/d/optout. >>> >> >> >> >> -- >> Tristan Rhodes >> > > > > -- > Tristan Rhodes > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
