Hi Jochen,

When you say index, do you mean the input? Also how can i check the 
retention for the index/input level? I have tried going to the input and 
but I haven't really made note if the messages are the same because I when 
i go to the input and the message is there, then it should be in the stream 
if the condition for the stream is met right? which in my case the 
condition is been met.

Thank you,

On Thursday, September 22, 2016 at 3:47:37 AM UTC-4, Jochen Schalanda wrote:
> Hi Kenneth,
> retention currently only works on index-level, not on stream-level.
> What exactly do you mean with disappears? Can you still find the message 
> via the universal search? Is the index containing the message still 
> available?
> Cheers,
> Jochen
> On Thursday, 22 September 2016 05:03:45 UTC+2, Kenneth Gyan wrote:
>> I have setup host devices consisting of routers and switches and the logs 
>> are been collected in the input with no issues. I have setup a stream to 
>> capture syslog messages with level 0-4. Whenever this condition is met, and 
>> it captures the syslog message in the stream, after some time (about a 
>> couple of hours), the message/s in the stream just disappears and I am 
>> trying to figure out why this is happening. Could it be a stream retention 
>> time that needs to be set? Any assistance on this will be helpful. Thank 
>> you. 

You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
For more options, visit https://groups.google.com/d/optout.

Reply via email to