Graylog2-如何将日志保留时间配置为1周 [英] Graylog2- how to config logs retention to 1 week

问题描述

我们正在使用某些Graylog2服务器(graylog服务器版本1.3.4).因为我们收到太多的日志消息，所以它需要大量的内存.我正在尝试将日志保留时间减少到1周，超过1周的每条日志消息都将被删除.但是，我无法在配置文件中找到任何值来做到这一点.
我使用了"max_time_per_index = 7d"值，但是max_time_per_index似乎只是定义了索引的寿命，直到旋转它并创建新索引为止，而不是该索引中的消息.
那么，将邮件保留时间设置为1周的最佳方法是什么?请帮我.非常感谢.

We are using some Graylog2 servers ( graylog-server version 1.3.4). Because we receive too much of log messages, it requires a lot of memory. I am trying to reduce the logs retention to 1 week, every log messages older than 1 week will be deleted. However, I cannot find out any value in configuration file to do that.
I used "max_time_per_index = 7d" value but max_time_per_index seems just define the age of an index until it's rotated and a new index is being created, not of the messages in that index.
So, what's the best way to set message retention to 1 week? Please help me. Thanks a lot.

推荐答案

可以使用Graylog_2及更高版本中的Web GUI轻松配置.

This can be easily configured using the Web GUI in Graylog_2 and later.

在管理"下拉菜单中导航至系统/索引".在设置"下，单击更新配置按钮.

Navigate to "System/Indices" in the Administration drop down menu. Under "Settings", click the Update configuration button.

将索引轮换配置配置为等于索引时间"，轮换周期= P1D(一天).您必须决定是否要删除索引"或只是将其关闭，然后将最大索引数"设置为"8".那应该保留当前日期以及最近7天的索引值.

Configure the Index Rotation Configuration to equal "Index Time", Rotation Period = P1D (a day). You'll have to decide whether or not you'd like to "Delete Index" or just close it, then set the Max number of indices to "8". That should keep the current day, and the last 7 days worth of indices.

注意:

Graylog企业版带有存档"日志文件的选项，从本质上压缩它们，并允许您将其移动到另一个存储位置(无论是到磁带还是仅移动到另一个存储位置).

Graylog Enterprise edition comes with an option to "Archive" log files, which essentially compresses them and allows you to move it to another storage location (whether to tape or just to another storage location).

这篇关于Graylog2-如何将日志保留时间配置为1周的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！