How to Retain elastic search data

[thegreekman]

Hello, what file do I need to modify to retain more data for my elastic search indices in kibana? If I go back past 2 months, I see 5 events when there should be millions.

[cm-ops]

In /opt/so/saltstack/local/pillar/global.sls you can edit close and delete days. But in addition, if you have a basic install, you would also need to take into account log size limit in the searchnode's minion pillar - /opt/so/saltstack/local/pillar/minions/. If you have the disk space available the ES indices will be deleted at the the delete days in the global.sls, if not, they will get deleted at the log size limit in the minion pillar.

[thegreekman]

Thanks for the reply

…

On Thu, May 4, 2023 at 9:08 AM Chris Morgret ***@***.***> wrote: In /opt/so/saltstack/local/pillar/global.sls you can edit close and delete days. But in addition, if you have a basic install, you would also need to take into account log size limit in the searchnode's minion pillar - /opt/so/saltstack/local/pillar/minions/. If you have the disk space available the ES indices will be deleted at the the delete days in the global.sls, if not, they will get deleted at the log size limit in the minion pillar. — Reply to this email directly, view it on GitHub <#10270 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGTAFR76O46X4DNAWLSUX4LXEOS6DANCNFSM6AAAAAAXTGA4DI> . You are receiving this because you authored the thread.Message ID: <Security-Onion-Solutions/securityonion/repo-discussions/10270/comments/5804555 @github.com>