When you say index, do you mean the input? Also how can i check the
retention for the index/input level? I have tried going to the input and
but I haven't really made note if the messages are the same because I when
i go to the input and the message is there, then it should be in the stream
if the condition for the stream is met right? which in my case the
condition is been met.
On Thursday, September 22, 2016 at 3:47:37 AM UTC-4, Jochen Schalanda wrote:
> Hi Kenneth,
> retention currently only works on index-level, not on stream-level.
> What exactly do you mean with disappears? Can you still find the message
> via the universal search? Is the index containing the message still
> On Thursday, 22 September 2016 05:03:45 UTC+2, Kenneth Gyan wrote:
>> I have setup host devices consisting of routers and switches and the logs
>> are been collected in the input with no issues. I have setup a stream to
>> capture syslog messages with level 0-4. Whenever this condition is met, and
>> it captures the syslog message in the stream, after some time (about a
>> couple of hours), the message/s in the stream just disappears and I am
>> trying to figure out why this is happening. Could it be a stream retention
>> time that needs to be set? Any assistance on this will be helpful. Thank
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
To view this discussion on the web visit
For more options, visit https://groups.google.com/d/optout.