How to config graylog data save days

July 2, 2015 5.1k views
MongoDB Ubuntu Logging

Hello All,
I’ve a question about the graylog settings. I need to save 30 days old data for our system. Anyone knows how to config this? Thanks

1 Answer

If you only want to retain log data for 30 days, you can set Graylog’s retention strategy in its configuration file:

elasticsearch_max_time_per_index = 1d
elasticsearch_max_number_of_indices = 30
retention_strategy = delete

This configures Elasticsearch to have one index per day with a total of 30 indexes meaning only 30 days worth of data will be stored. You may see better search performance if you adjust the values (e.g. 12 hours and 60 indices).

Have another answer? Share your knowledge.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!