-2

What is best practices by config graylog rotation/retantion indexes?

stepan
  • 1
  • Take a look at my answer on serverfault for a similar question: https://serverfault.com/a/1063895/318166 – Swisstone Dec 28 '21 at 19:02

1 Answers1

0

If using open source, set retention to delete after reaching the set number of indices.

If using enterprise, set it to archive, then delete.

Blackbox
  • 59
  • 3