Hi, indices marked as "reopened" will not be closed or deleted by the configured retention strategy at all.
If you want to remove that index, simply delete it in the Graylog web interface. Cheers, Jochen On Thursday, 3 March 2016 16:07:34 UTC+1, kaiser wrote: > > > <https://lh3.googleusercontent.com/-GtAG4WcEspg/VthS5rZtTiI/AAAAAAAACXg/0L6n43q_MQo/s1600/oldest_indice.png> > > > <https://lh3.googleusercontent.com/-p_rsqZWKBk4/VthSxWn2wyI/AAAAAAAACXc/IwS6TtMejDI/s1600/current_indice.png> > Hello Jochen, > > What I see is that my current indice is graylog2_60 > and my oldest_one is graylog2_6 which is reopened and I don't understand > why it is not deleted. > > My rotation config: > > # Graylog will use multiple indices to store documents in. You can > configured the strategy it uses to determine > # when to rotate the currently active write index. > # It supports multiple rotation strategies: > # - "count" of messages per index, use elasticsearch_max_docs_per_index > below to configure > # - "size" per index, use elasticsearch_max_size_per_index below to > configure > # valid values are "count", "size" and "time", default is "count" > rotation_strategy = count > > # (Approximate) maximum number of documents in an Elasticsearch index > before a new index > # is being created, also see no_retention and > elasticsearch_max_number_of_indices. > # Configure this if you used 'rotation_strategy = count' above. > elasticsearch_max_docs_per_index = 20000000 > > # (Approximate) maximum size in bytes per Elasticsearch index on disk > before a new index is being created, also see > # no_retention and elasticsearch_max_number_of_indices. Default is 1GB. > # Configure this if you used 'rotation_strategy = size' above. > #elasticsearch_max_size_per_index = 1073741824 > > # (Approximate) maximum time before a new Elasticsearch index is being > created, also see > # no_retention and elasticsearch_max_number_of_indices. Default is 1 day. > # Configure this if you used 'rotation_strategy = time' above. > # Please note that this rotation period does not look at the time > specified in the received messages, but is > # using the real clock value to decide when to rotate the index! > # Specify the time using a duration and a suffix indicating which unit you > want: > # 1w = 1 week > # 1d = 1 day > # 12h = 12 hours > # Permitted suffixes are: d for day, h for hour, m for minute, s for > second. > #elasticsearch_max_time_per_index = 1d > > > My retention config: > > # Disable message retention on this node, i. e. disable Elasticsearch > index rotation. > #no_retention = false > > # How many indices do you want to keep? > elasticsearch_max_number_of_indices = 20 > > # Decide what happens with the oldest indices when the maximum number of > indices is reached. > # The following strategies are availble: > # - delete # Deletes the index completely (Default) > # - close # Closes the index and hides it from the system. Can be > re-opened later. > retention_strategy = delete > > > > Regards. > >> >> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/868834d6-abfc-45f8-8c5c-e90849ac77a2%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
