Hi Hema, multi-tiered data retention is currently not supported by Graylog. You could probably build something yourself quite quickly using the Elasticsearch API directly (e. g. check which indices are already closed and then create a snapshot of them). Maybe you could even use Curator (http://www.elastic.co/guide/en/elasticsearch/client/curator/current/about.html) for that.
Cheers, Jochen On Friday, 3 April 2015 01:35:00 UTC+2, Hema Kumar wrote: > > Hi, > Is there a way to do a log Rotation > > - My policy is to hold 60 days of indices which was done in the configs, > the logs more than 60 days are closed. > - The second thing is after 60 days the closed indices should be moved to > different drive and should hold it for 120 days but should still be > available in graylog for easier access to open and search for it. > - The third is after 120 days the logs can be archived using a zip utility > and stored in different drive or deleted. > > * Numbers are just reference. What i am trying to ask is, would graylog be > setting such log rotation policy instead of external tools. > > Really like the tool that is being developed. Thanks Much. > > Regards, > Hema. > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
