From f7aad4832fdf6000784bc07642fb90bc51119fbb Mon Sep 17 00:00:00 2001 From: Kevin Carter Date: Tue, 24 Jul 2018 09:45:13 -0500 Subject: [PATCH] Update retention policy weighting This change adds retention policy weighting based on experience with the indexes in production in large scale clouds. Change-Id: I0d09d4cfc68f70fe790170d5d54f1585616c5524 Signed-off-by: Kevin Carter --- elk_metrics_6x/vars/variables.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/elk_metrics_6x/vars/variables.yml b/elk_metrics_6x/vars/variables.yml index f8d900e6..20a9decf 100644 --- a/elk_metrics_6x/vars/variables.yml +++ b/elk_metrics_6x/vars/variables.yml @@ -42,12 +42,12 @@ elastic_beat_storage_constant: 512 elastic_beat_retention_policy_hosts: logstash: "{{ groups['elastic-logstash'] | default([null]) | length }}" apm: "{{ groups['apm-server'] | default([null]) | length }}" - auditbeat: "{{ groups['hosts'] | default([null]) | length }}" - filebeat: "{{ groups['hosts'] | default([null]) | length }}" + auditbeat: "{{ (groups['hosts'] | default([null]) | length) * 2 }}" + filebeat: "{{ (groups['hosts'] | default([null]) | length) * 2 }}" heartbeat: "{{ groups['kibana'][:3] | default([null]) | length }}" - journalbeat: "{{ groups['all'] | default([null]) | length }}" - metricbeat: "{{ groups['all'] | default([null]) | length }}" - packetbeat: "{{ groups['hosts'] | default([null]) | length }}" + journalbeat: "{{ (groups['all'] | default([null]) | length) * 1.5 }}" + metricbeat: "{{ (groups['all'] | default([null]) | length) * 1.5 }}" + packetbeat: "{{ (groups['hosts'] | default([null]) | length) * 5 }}" # This is the URL external services can use to communicate with the # elasticsearch cluster.