Dear, I have a Graylog 1.2 server which receives lot of messages per seconds. I need to have a rotation strategy in order to mantain 6 months of logs, and after that time the indexes will be deleted.
I think I have to add this lines to the /etc/graylog/server/server.conf file: rotation_strategy = time elasticsearch_max_time_per_index = 1d elasticsearch_max_number_of_indices = 180 # 6 months retention_strategy = delete Is this configuration OK??? And also, is it a good idea to increase the elasticsearch_max_time_per_index from 1d to 10d, and in this case elasticsearch_max_number_of_indices = 18??? Thanking in advance. Roberto. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/8ab1d821-c69e-4cfe-93b6-4f73b244403a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
