How to config graylog data save days

July 2, 2015 502 views
Logging MongoDB Ubuntu

Hello All,
I've a question about the graylog settings. I need to save 30 days old data for our system. Anyone knows how to config this? Thanks

1 Answer

If you only want to retain log data for 30 days, you can set Graylog's retention strategy in its configuration file:

elasticsearch_max_time_per_index = 1d
elasticsearch_max_number_of_indices = 30
retention_strategy = delete

This configures Elasticsearch to have one index per day with a total of 30 indexes meaning only 30 days worth of data will be stored. You may see better search performance if you adjust the values (e.g. 12 hours and 60 indices).

Have another answer? Share your knowledge.