<https://lh3.googleusercontent.com/-GtAG4WcEspg/VthS5rZtTiI/AAAAAAAACXg/0L6n43q_MQo/s1600/oldest_indice.png>
<https://lh3.googleusercontent.com/-p_rsqZWKBk4/VthSxWn2wyI/AAAAAAAACXc/IwS6TtMejDI/s1600/current_indice.png> Hello Jochen, What I see is that my current indice is graylog2_60 and my oldest_one is graylog2_6 which is reopened and I don't understand why it is not deleted. My rotation config: # Graylog will use multiple indices to store documents in. You can configured the strategy it uses to determine # when to rotate the currently active write index. # It supports multiple rotation strategies: # - "count" of messages per index, use elasticsearch_max_docs_per_index below to configure # - "size" per index, use elasticsearch_max_size_per_index below to configure # valid values are "count", "size" and "time", default is "count" rotation_strategy = count # (Approximate) maximum number of documents in an Elasticsearch index before a new index # is being created, also see no_retention and elasticsearch_max_number_of_indices. # Configure this if you used 'rotation_strategy = count' above. elasticsearch_max_docs_per_index = 20000000 # (Approximate) maximum size in bytes per Elasticsearch index on disk before a new index is being created, also see # no_retention and elasticsearch_max_number_of_indices. Default is 1GB. # Configure this if you used 'rotation_strategy = size' above. #elasticsearch_max_size_per_index = 1073741824 # (Approximate) maximum time before a new Elasticsearch index is being created, also see # no_retention and elasticsearch_max_number_of_indices. Default is 1 day. # Configure this if you used 'rotation_strategy = time' above. # Please note that this rotation period does not look at the time specified in the received messages, but is # using the real clock value to decide when to rotate the index! # Specify the time using a duration and a suffix indicating which unit you want: # 1w = 1 week # 1d = 1 day # 12h = 12 hours # Permitted suffixes are: d for day, h for hour, m for minute, s for second. #elasticsearch_max_time_per_index = 1d My retention config: # Disable message retention on this node, i. e. disable Elasticsearch index rotation. #no_retention = false # How many indices do you want to keep? elasticsearch_max_number_of_indices = 20 # Decide what happens with the oldest indices when the maximum number of indices is reached. # The following strategies are availble: # - delete # Deletes the index completely (Default) # - close # Closes the index and hides it from the system. Can be re-opened later. retention_strategy = delete Regards. > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/6af685f7-4861-4057-a974-0e15115edced%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
