Hi, Phil already mentioned the part of the Graylog documentation explaining how to expand the disk space in the virtual machine appliances: http://docs.graylog.org/en/2.1/pages/configuration/graylog_ctl.html#extend-ova-disk
You can also activate a better compression in Elasticsearch at the expense of CPU usage: - https://www.elastic.co/guide/en/elasticsearch/reference/2.4/index-modules.html#_static_index_settings - https://www.elastic.co/blog/elasticsearch-storage-the-true-story-2.0 - https://www.elastic.co/blog/store-compression-in-lucene-and-elasticsearch And of course there's always the possibility to tune your index retention settings to simply keep less logs on the System / Indices page of the Graylog web interface. Cheers, Jochen On Wednesday, 21 September 2016 04:43:24 UTC+2, [email protected] wrote: > > I have Elasticsearch data and it's logs written to a 2nd HDD than where > the OS is. This HDD, 100GB, is constantly getting maxed out with ES's logs > which I manually delete, but I see the indices are slowly creeping up in > size too. Is there a compression option that I am missing? Or how would I > move data to a 3rd HDD, bigger in size of course, without losing anything > collected this far? Would it be as simple as stopping Graylog, copying the > folders over, define new path, and restart Graylog? > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/7757d463-f338-4043-af45-18a2ae05f7f1%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
