Archival strategy of indices

Elastic Stack Elasticsearch
1

Hello,

We have about 40 different indices being produced everyday. We currently have an alias setup for to point to the current business day index, and every night when the day rolls over, we create a new index and recreate the alias.

Ideally we would like to make the previous day's index read-only and move it to SAN. We would still be able to access it to run queries etc. I don't think the snapshot feature will allow us to query the index without restoring it.

Any thoughts/suggestions and best practises for what I am trying to achieve?

Thanks!
G-Thang

2

Elasticsearch Curator is usually what we recommend here.

3

Thanks for that, but unfortunately I can't install the package in the production host(security drama). I will just have to use the existing REST calls :(.

4

Curator doesn't have to be installed in the cluster. It only needs client access, which supports all X-Pack Security/SSL options.