Graylog: Choosing a rotation strategy

This documentation is part of the Manage retention guide. You can view the complete guide here: How to configure log retention.

👋 Welcome to the Stackhero documentation!

Stackhero offers a ready-to-use Graylog cloud solution that provides a host of benefits, including:

• Unlimited and dedicated SMTP email server included.
• Effortless updates with just a click.
• Customisable domain name secured with HTTPS (for example, https://logs.your-company.com).
• Optimal performance and robust security powered by a private and dedicated VM.

Save time and simplify your life: it only takes 5 minutes to try Stackhero's Graylog cloud hosting solution!

Graylog offers three retention strategies:

1. "Index time" defines the maximum duration for which messages are kept in each index, for example, 14 days per index.
2. "Index message count" sets the maximum number of messages per index, for example, 20 million messages per index.
3. "Index size" limits the maximum size of an index, for example, 40 GB per index.

You can select one of these strategies according to your specific requirements. For instance, choosing "Index time" ensures that you always have logs from the past X days.

Be sure to accurately estimate your disk space requirements.

For example, if you store 1 GB of logs per day and decide to keep logs for the past 365 days, you will need 365 GB of disk space. Remember to reserve additional space for system operations as well (see below).