search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.36k stars 1.06k forks source link

Option to skip time-based index set rotation if latest index is empty #16609

Open coffee-squirrel opened 1 year ago

coffee-squirrel commented 1 year ago

What?

There should be an option to prevent time-based index set rotation if the latest index is empty (i.e. no messages were stored).

Why?

13099 (#13028) introduced support for skipping time-based rotation if the index set is empty. Index set rotation will still occur, however, if any index in the set contains messages.

In our case, we needed to stop ingesting messages from a particular type of source (which was going into a dedicated index set with 1 day rotation) for a while. The index set still contains older indices with messages, but there are now many empty "newer" indices.

Your Environment

kroepke commented 1 year ago

Have you considered using time-size optimizing strategy yet? That might be a better experience for this type of situation.

coffee-squirrel commented 1 year ago

I don't think we'd want to permanently move away from guaranteed daily index rotation (1 index == 1 day is helpful with archival, retention, etc.), but yeah in retrospect we probably could have temporarily switched to that strategy when we knew there wasn't going to be any activity. Not being fully confident in what would happen during such a change (and subsequent revert), though, I might have just left it as-is and periodically deleted the empty indices.

I think this feature would still be a good addition to the time-based rotation strategy, as it would fix the rest of the "empty index" problem for those who want to keep a well-defined rotation interval (when there are messages). We've only ran into this a few times over the years, though, so no worries if it's not something you all want to include.