I'm looking for a solution to update alias based on time indices. Especially to clear old indices.
I have created an indice template:
Logstash create a daily indices who match this template. New indices are added to the alias.
My goal is to remove old indices from my alias: logs-data-current after 2 days.
I thought I can achieve that with ilm. However my understing is ILM will manage indice lifecycle (hot, warm, cold) but without impact on alias cleanup.
The Elasticsearch documentation mention the capability to have a write alias with a "cleanup" (write alias can have only one indice linked) but that does not answer to my need.
My need is to have an alias to query only the last 24 hours data.
Right now the only solution I have is to schedule a script to call the alias api to clear old indices.
I'm highly interested by a solution to avoid using a script.