Hi all, I've heard about a time-based retention policy to rotate indices but I can't find such a policy in *Graylog v1.0*. Here what my */opt/graylog/graylog.conf* looks like
... elasticsearch_max_docs_per_index = 20000000 # Disable message retention on this node, i. e. disable Elasticsearch index rotation. #no_retention = false elasticsearch_max_number_of_indices = 20 # Decide what happens with the oldest indices when the maximum number of indices is reached. # The following strategies are availble: # - delete # Deletes the index completely (Default) # - close # Closes the index and hides it from the system. Can be re-opened later. retention_strategy = delete ... Did I miss something ? Can someone tell me how to configure Gralog to keep logs for around 1 year before rotate ? Thanks. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
