# Automated Archival of data in indices

**URL:** https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [September 23, 2020, 8:52pm UTC](https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707 "2020-09-23T20:52:19Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![ted1621](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ted1621/32/63595_2.png) [@ted1621](https://discuss.elastic.co/u/ted1621)
#### Post date: [September 23, 2020, 8:52pm UTC](https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707/1 "2020-09-23T20:52:20Z")

</div>

Can anyone provide instructions on how I would set up a automated task to archive and move to cold storage any data in my indices that is over 45 days old. Also in regards to indices that are no longer receiving data streams because the \*beat agent has been upgraded what is the best practice for those indices? Delete them or what?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 23, 2020, 9:34pm UTC](https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707/2 "2020-09-23T21:34:57Z")

</div>

Moving data out of _indices_ is expensive. Moving indices themselves is a lot easier.  
Can you clarify which one you want?

---

<div class="post-metadata">

### Author: ![ted1621](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ted1621/32/63595_2.png) [@ted1621](https://discuss.elastic.co/u/ted1621)
#### Post date: [September 23, 2020, 9:53pm UTC](https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707/3 "2020-09-23T21:53:10Z")

</div>

I am trying to have my indices not get so large. So moving older events out of the indices. But if that is hard, then removing unused indices from winlogbeat-\* as an example?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 23, 2020, 10:10pm UTC](https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707/4 "2020-09-23T22:10:21Z")

</div>

If you're using Beats, then check out [ILM](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-start.html). It's the preferred method of managing this.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 21, 2020, 10:10pm UTC](https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707/5 "2020-10-21T22:10:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
