Graylog: Define the retention parameters
This documentation is part of the Manage retention guide. You can view the complete guide here: How to configure log retention.
👋 Welcome to the Stackhero documentation!
Stackhero offers a ready-to-use Graylog cloud solution that provides a host of benefits, including:
- Unlimited and dedicated SMTP email server included.
- Effortless updates with just a click.
- Customisable domain name secured with HTTPS (for example, https://logs.your-company.com).
- Optimal performance and robust security powered by a private and dedicated VM.
Save time and simplify your life: it only takes 5 minutes to try Stackhero's Graylog cloud hosting solution!
By default, Graylog limits the number of indices to 20. You can adjust this value to suit your needs. For example, if you want to keep logs from the past 365 days, you could distribute retention across indices by dividing 365 days by 20 indices, which results in roughly 19 days per index.
You can perform similar calculations for the other strategies:
- For the "Index message count" strategy: if you want to keep 200 million messages with a maximum of 20 indices, then 200 million messages divided by 20 indices gives 10 million messages per index.
- For the "Index size" strategy: if you want to retain 400 GB of logs with a maximum of 10 indices, then 400 GB divided by 10 indices gives 40 GB per index.
We recommend always keeping at least 15 GB of free disk space for logs, Graylog's journal, and MongoDB data.
If available disk space runs out, OpenSearch will block its operations and you will need to upgrade to a larger instance.