Graylog: Defining retention parameters

This documentation is part of the Manage retention guide. You can view the complete guide here: How to configure log retention.

👋 Welcome to Stackhero documentation

Stackhero offers a fully managed Graylog cloud solution designed for speed and simplicity. You can:

• Count on an unlimited, dedicated SMTP email server included with your service.
• Apply updates easily with a single click, with no manual intervention required.
• Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), providing your team with secure, direct access.
• Benefit from strong performance and security on a private, dedicated infrastructure with no shared resources or noisy neighbours.

Focus on your data, not your tools: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.

By default, Graylog limits the number of indices to 20. You can adjust this value to fit your needs. For example, if you want to keep logs from the past 365 days, you could distribute retention across indices by dividing 365 days by 20 indices, which gives about 19 days per index.

You can do similar calculations for the other strategies:

1. For the "Index message count" strategy: if you want to keep 200 million messages with a maximum of 20 indices, then 200 million messages divided by 20 indices gives 10 million messages per index.
2. For the "Index size" strategy: if you want to keep 400 GB of logs with a maximum of 10 indices, then 400 GB divided by 10 indices gives 40 GB per index.

We recommend always keeping at least 15 GB of free disk space for logs, Graylog's journal, and MongoDB data.

If available disk space runs out, OpenSearch will block its operations and you will need to upgrade to a larger instance.