Hi, The configuration wasn't at fault here; it was simply the fact that the _internal index contained the _internal indexes of the other instances that led me astray. But your answer still helped me, so thanks ^^
... View more
Hi, thanks for your answer ; in fact, I have 4 indexers + a cluster of 3 search Head + 3 search Head for specific needs ; so, I round up every _internal indexes of these instances + every UF an HF send a little bit of their _internal indexes When I add up all these sources, I get the total shown on the interface Now I know it's a normal behaviour, it's even logical at the end, but it doesn't look like it at a first glance. Thanks for your answer.
... View more
I'm talking about cluster indexer ; the _cluster/local/indexes.conf are correct, the limit size defined in this file are correctly applied as Max Size in the indexer. I check if a configuration conflict was there (local configuration in the indexers or another indexes.conf in etc/{master, manager}-app) but I didn't catch any. I don't know what to think next
... View more
Hello there, I have an issue with the internal index of my indexers (_audit, _introspection, _metrics) because, for an unknown reason, the logs didn't rotate properly and always exceed the defined Max Size of the internal indexes. For example, for _metrics, we defined 500 Mo max size, but we actually have 6,41 Go of logs... How can I manage to force the internal index to respect the Max Size defined ? Thanks for your help Cheers
... View more