Sizing Graylog storage and the message journal
Estimating disk for Graylog: the daily ingest times retention times 120 percent formula, journal capacity for backend outages, SSD placement and how replicas and warm tiers change the numbers.
Graylog storage, archiving and data tiering
Keeping Graylog log data for as long as required at a cost that works: storage sizing, index set templates, warm tier snapshots and archives.
Graylog warm tier with searchable snapshots
Moving older Graylog indices to a cheaper warm tier: Enterprise licensing, S3, GCS or file system repositories, slower search, minimum hot days and the OpenSearch version or Data Node it requires.
Archiving Graylog logs to S3 or object storage
Keeping years of logs outside the search cluster with Graylog archiving: backends, compression choices, checksums for integrity, archive retention and archiving before index deletion.
Restoring archived Graylog logs for investigations and audits
Bringing archived messages back into a searchable index when an investigation or auditor needs them: restore batches, load on the search backend, leader-only restores and storage for restored data.
Graylog index set templates for retention policies
Standardizing retention across log sources with index set templates: the built-in 7, 14 and 30 day hot templates, custom templates for shards and replicas, shard size settings and a default template.
