Well, after 4 days graylog became unresponsive (again) and I had to delete the one big indice and start from scratch again. Although I really like graylogs frontend I might need to get logstash/kibana up and running if we keep running into page error 200 after a few days of collecting logs.
Am Mittwoch, 3. September 2014 16:32:44 UTC+2 schrieb Jerri Son: > > Hi, > I had some trouble with instances going missing and thus lacking logs from > several days ago. > As far as I could tell, the indices were: > -physically there > -not closed > -API queryable > -closable and reopenable > > Now, when I did query "IndexRanges" only 8 out of 11 Indices were > "included" no matter how many times > I rebuilt/synced the ranges. > My setup was that I had max-docs set to 20m and number of indices to 50. I > noticed, too, that when the number indices > went > 8 older ones just fell out of ranges. Is there a hard coded limit > for the amount of opened indices I failed to see? > > My solution for now was to create a rather huge index with 200m maxdocs > and max number of indices of 4. > > I tried with 0.20.6 and the latest 0.21beta4. Any ideas? Or are bigger > indices the way to go? > > Cheers! > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
