Hi All - Using Graylog v0.20.1 and ES 0.90.10, and am having my disk space maxed out because indices are not rotating out. My elasticsearch data directory shows indices graylog2_recent, graylog2_0, ...., graylog2_173.
Anyone have experience with this? I'm going to use the ES API to clear out some older indices and get my setup working again, but need to figure out the rotation issue for longterm resolution. I'm using default config settings: # Embedded elasticsearch configuration file # pay attention to the working directory of the server, maybe use an absolute path here elasticsearch_config_file = /etc/graylog2-elasticsearch.yml elasticsearch_max_docs_per_index = 20000000 # How many indices do you want to keep? # elasticsearch_max_number_of_indices*elasticsearch_max_docs_per_index=total number of messages in your setup elasticsearch_max_number_of_indices = 20 # Decide what happens with the oldest indices when the maximum number of indices is reached. # The following strategies are availble: # - delete # Deletes the index completely (Default) # - close # Closes the index and hides it from the system. Can be re-opened later. retention_strategy = delete -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
