Hi Oliver, I would start with one index a day and a max of 180 indices (30 days * 6 month). Journal size depends on you peek load. For normal setups 5Gb should be ok.
`sudo graylog-ctl set-retention --time=24 --indices=180 --journal=5` Cheers, Marius On 4 May 2015 at 16:32, Olivier <[email protected]> wrote: > Hello, > > I'm using the Graylog OVA (1.0) and I want to achieve a retention time of > 6 months for the messages and I have the following questions: > > > - What would be the recommendation for the settings? > > > 1. elasticsearch_max_time_per_index? > 2. elasticsearch_max_number_of_indices? > > > - Currently, it is configured with the default settings (rotation > strategy: size, max size per index: 1GB and max number of indices: 10). How > can I reconfigure the appliance for a retentime time of 6 months? > - it's seems the command support only "hour" so it would be 4320 > hours for 6 months (24*30*6) > - sudo graylog-ctl set-retention --time=*4320* --indices=*??* > --journal=*??* > > > Thank you, > Olivier > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- Developer Tel.: +49 (0)40 609 452 077 Fax.: +49 (0)40 609 452 078 TORCH GmbH - A Graylog Company Steckelhörn 11 20457 Hamburg Germany https://www.graylog.com <https://www.torch.sh/> Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 Geschäftsführer: Lennart Koopmann (CEO) -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
