Alias update

[QwerFact]

Dear community,
I'm looking for a solution to update alias based on time indices. Especially to clear old indices.

I have created an indice template:
PUT _template/data
{
"index_patterns": ["logs-data-*"],
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1,
"index.lifecycle.name": "ilm-data-daily",
"index.lifecycle.rollover_alias": "logs-data-current"
},
"aliases": {
"logs-data-current":{}
}
}

Logstash create a daily indices who match this template. New indices are added to the alias.

My goal is to remove old indices from my alias: logs-data-current after 2 days.
I thought I can achieve that with ilm. However my understing is ILM will manage indice lifecycle (hot, warm, cold) but without impact on alias cleanup.
The Elasticsearch documentation mention the capability to have a write alias with a "cleanup" (write alias can have only one indice linked) but that does not answer to my need.
My need is to have an alias to query only the last 24 hours data.

Right now the only solution I have is to schedule a script to call the alias api to clear old indices.

I'm highly interested by a solution to avoid using a script.

Regards.

[Glen_Smith]

I believe you will have to use some client (e.g. Curator) to accomplish this.

I see a relevant issue opened very recently: Add ILM action to add/remove aliases.

[QwerFact]

The opened issue is exactly what I expect:
PUT _ilm/policy/ilm-data-daily
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "2d"
},
"set_priority": {
"priority": 100
}
}
},
"warm": {
"min_age": "2d",
"actions": {
"aliases": {
"remove": ["logs-data-*-current"]
}
}
},
"cold": {
"min_age": "36d",
"actions": {
"freeze": {}
}
},
"delete": {
"min_age": "91d",
"actions": {
"delete": {}
}}}}}

Unfortunately, not implemented yet. I will achieve this with Curator.

Thank you for your feedback.