graylog_indices

graylog_indices配置
1.在导航栏System/Indices -> Create Index set,创建一个新索引;
2.Select rotation strategy选择Index Time（按时间进行轮转），Rotation period 轮转的时间为P10D（D代表天，H代表小时，M代表月）;
3.我们再往下进行定义Index的清理、保留策略。我们选择Select retention strategy 为Delete Index（删除索引），Max number of indices 选择3个。给大家解释一下就是4xx_5xx_log这个索引只保留3个，也就是3x10D，一个月的日志，点击save保存;

ISO 8601 Durations are expressed using the following format, where (n) is replaced by the value for each of the date and time elements that follow the (n):
P(n)Y(n)M(n)DT(n)H(n)M(n)S
Where:
P is the duration designator (referred to as "period"), and is always placed at the beginning of the duration.
Y is the year designator that follows the value for the number of years.
M is the month designator that follows the value for the number of months.
W is the week designator that follows the value for the number of weeks.
D is the day designator that follows the value for the number of days.
T is the time designator that precedes the time components.
H is the hour designator that follows the value for the number of hours.
M is the minute designator that follows the value for the number of minutes.
S is the second designator that follows the value for the number of seconds.
Terminateddisk平均等待时间是持续时间指示器(称为“period”)，并且总是放在持续时间的开头。

Y是年份指示器，跟随年份数的值。

M是月份指示器，它跟在月份数的值之后。

W是周指示符，它跟在表示周数的值之后。

D是日期指示器，它跟在表示天数的值之后。

T是时间指示符，在时间分量之前。

H是小时指示器，紧跟在小时数的值之后。

M是分钟指示器，它跟在分钟数的值之后。

S是秒数值后面的第二个指示符。
For example:
P3Y6M4DT12H30M5S
Represents a duration of three years, six months, four days, twelve hours, thirty minutes, and five seconds.
本文链接：https://z.itpub.net/article/detail/3719FBFC0DFD0636435B75D53A1672C1