10 days log deletion policy using kibana tool

Elastic Stack Kibana
1

Hi All,

Could you please provide the step by step to configure the 90 days log retention automatically.

tried the following steps, but it seems the logs are not deleting

  1. Stack management -> created a new life cycle policy
    selected the cold phase enabled the rollover indecies and then provided the 90 days .

  2. created a index management template

image

Could you please let me know the steps to configure to deleting the logs automatically.
Please provide the steps

2

I @kumar918 Welcome to the Community.

What Version?

Looks like you are using Metricbeat?
Where are you running Elastic Cloud?
Do you have a Cold Tier?

Perhaps get started with leveraging our detailed documentation/steps here

Otherwise, you need to show the exact steps/output that you are on and what the exact results are.

3

Hi Stephenb,
Looks like you are using Metricbeat? _yes
Where are you running Elastic Cloud?--not cloud , installed on server
during the configuraiton used the cold tier.

4
  1. created index policy name as "apm-rollover-90days"

selected the warm phase and then selected the option as Delete,
Added the 90 days policy

  1. Index Management

index template name as "Kibana logs "(testing purpose)

During the index pattern added the configuration " metricbeat-"

Saved the index

After the template creation, added this index to life cycle policy .

Some how the logs aren't deleting automatically.

can you please give the guidance of this configuration.

It looks like some where missed the configuration

5

Apologies we need more detail.

What version are you on?

So if this is metrics why are you changing / creating the policy
"apm-rollover-90days"

Apologies I am unclear what that means ... an ILM policy is added to the template, then when an index is created the IF the new index meets the pattern of the index template the ILM Policy will be assigned to the index

So to help we are going to need to see everything

Using Kibana -> Dev Tools

GET _index_template/your-template-name

GET _ilm/policy/your-policy-name

Also show the _ilm/explain for one of the indices that is "not working"
GET .ds-my-index-name /_ilm/explain

6

I am using the vesion elasticsearch-8.3.2.
Also log-may15 May 15, 2023 @ 18:29:14.000
like this the logs are creating every 10 mins and have to delete this log previous 10 days logs.

So if this is metrics why are you changing / creating the policy
"apm-rollover-90days" ---Created new index policy and new indices and assigned this log

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.