Can anyone provide instructions on how I would set up a automated task to archive and move to cold storage any data in my indices that is over 45 days old. Also in regards to indices that are no longer receiving data streams because the *beat agent has been upgraded what is the best practice for those indices? Delete them or what?
Moving data out of indices is expensive. Moving indices themselves is a lot easier.
Can you clarify which one you want?
I am trying to have my indices not get so large. So moving older events out of the indices. But if that is hard, then removing unused indices from winlogbeat-* as an example?
If you're using Beats, then check out ILM. It's the preferred method of managing this.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.