Default index partition large in size
Article ID: 400139
Updated On:
Products
Issue/Introduction
Why is the Default partition so large?
Environment
8.x
Cause
If a log message does not match the criteria of any of the user-created partitions, it gets placed into the default partition.
Resolution
Each partition is responsible for collecting and storing the logs for its retention policy. You can apply filters to each partition to define what logs to collect versus reject.
See vRealize Log Insight Index Partitions and Variable Retention Deep Dive
Additional Information
You can retain log data in a partition with a filter and a retention period. Index partitions let you define different retention periods for different types of logs. For example, logs with sensitive information might require a short retention period, such as five days. You can also archive the data in an index partition to an NFS mount, to retain the logs for an extended period.
Feedback
