22.graylog_indices

发表于 linux 分类,标签:

graylog_indices配置

1.在导航栏System/Indices -> Create Index set,创建一个新索引;

2.Select rotation strategy选择Index Time(按时间进行轮转),Rotation period 轮转的时间为P10D(D代表天,H代表小时,M代表月);

3.我们再往下进行定义Index的清理、保留策略。我们选择Select retention strategy 为Delete Index(删除索引),Max number of indices 选择3个。给大家解释一下就是4xx_5xx_log这个索引只保留3个,也就是3x10D,一个月的日志,点击save保存;


ISO 8601 Durations are expressed using the following format, where (n) is replaced by the value for each of the date and time elements that follow the (n):

P(n)Y(n)M(n)DT(n)H(n)M(n)S

Where:

P is the duration designator (referred to as "period"), and is always placed at the beginning of the duration.

Y is the year designator that follows the value for the number of years.

M is the month designator that follows the value for the number of months.

W is the week designator that follows the value for the number of weeks.

D is the day designator that follows the value for the number of days.

T is the time designator that precedes the time components.

H is the hour designator that follows the value for the number of hours.

M is the minute designator that follows the value for the number of minutes.

S is the second designator that follows the value for the number of seconds.

Terminateddisk平均等待时间是持续时间指示器(称为“period”),并且总是放在持续时间的开头。  


Y是年份指示器,跟随年份数的值。  


M是月份指示器,它跟在月份数的值之后。  


W是周指示符,它跟在表示周数的值之后。  


D是日期指示器,它跟在表示天数的值之后。  


T是时间指示符,在时间分量之前。  


H是小时指示器,紧跟在小时数的值之后。  


M是分钟指示器,它跟在分钟数的值之后。  


S是秒数值后面的第二个指示符。 

For example:

P3Y6M4DT12H30M5S

Represents a duration of three years, six months, four days, twelve hours, thirty minutes, and five seconds.

本文链接:https://z.itpub.net/article/detail/3719FBFC0DFD0636435B75D53A1672C1


0 篇评论

发表我的评论