Il 28/07/15 14:13, Jochen Schalanda ha scritto:
you can add your index template to the Elasticsearch configuration file
(https://www.elastic.co/guide/en/elasticsearch/reference/0.90/indices-templates.html#config)
referenced in the elasticsearch_config_file setting in the Graylog
configuration file
Thanks, but the link you posted just talks about putting the template
file into the config/templates directory, which is what I already did,
Also, I tried using the elasticsearch_config_file setting in Graylog
config to make it point to /etc/elasticsearch/elasticsearch.yml but then
I ran into the problem described here, so I had to roll back:
https://groups.google.com/forum/#!topic/graylog2/PvP2BYNe0xg
Anyway, I found the problem: my template file was missing a comma before
"message", sorry :-P. I should have looked better at the logs.
So now as far as I can see my template file is working fine, I can even
only use the "message" mapping without the need to add the "_default_" one.
Apart from this, I added the indices.ttl.interval setting in
elasticsearch.yml, this should tell it how often expired documents must
be deleted, e.g. "7d" for 7 days.
--
01
--
You received this message because you are subscribed to the Google Groups
"graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
