Graylog: Configure the retention policy

This documentation is part of the Manage retention guide. You can view the complete guide here: How to configure log retention.

👋 Welcome to the Stackhero documentation!

Stackhero offers a ready-to-use Graylog cloud solution that provides a host of benefits, including:

• Unlimited and dedicated SMTP email server included.
• Effortless updates with just a click.
• Customisable domain name secured with HTTPS (for example, https://logs.your-company.com).
• Optimal performance and robust security powered by a private and dedicated VM.

Save time and simplify your life: it only takes 5 minutes to try Stackhero's Graylog cloud hosting solution!

To configure the retention policy, go to the Graylog interface. Under the "System" menu, select "Indices" and click the "Edit" button in the "Default index set" section.

In the example below, the configuration sets a maximum of 27 indices, with each index retaining 14 days of logs. This setup retains logs for approximately a year (378 days).

We do not recommend keeping more than 14 days of messages per index.

Retention configuration to keep logs for a year

When choosing "Index time" as a rotation policy, you must define the duration using the ISO8601 Duration standard.

For example, "P7D" means 7 days, "P14D" means 14 days, and so on.