# Automatically delete 1 month old records/documents(without deleting index) in elastic search/kibana
**URL:** https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041
**Category:** Elasticsearch
**Created:** [December 9, 2018, 11:18am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041 "2018-12-09T11:18:54Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 9, 2018, 11:18am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/1 "2018-12-09T11:18:55Z")
When i try to create time based index for filebeats,it says "unable to fetch mapping , do you have indices matching that pattern". However the normal index is getting created when i type in filebeat-\*.
Can anybody please tell what's wrong here!
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 10, 2018, 5:30pm UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/3 "2018-12-10T17:30:09Z")
Could be really helpful if you can post the answer .
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 11, 2018, 11:03pm UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/4 "2018-12-11T23:03:03Z")
Your topic title doesn't really match the question, you may want to edit it to make it clear what you are looking for?
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 12, 2018, 6:24am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/5 "2018-12-12T06:24:44Z")
I have updated the topic.
Request to to please provide a quick solution for this issue .I am new to ES & Its a critical use case for me , and i have been unable to find an answer for this in ES documentation.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 6:51am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/6 "2018-12-12T06:51:09Z")
If you list the indices in the cluster, has winlogbeat indexed any data?
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 12, 2018, 9:02am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/7 "2018-12-12T09:02:43Z")
yes on hitting this url
[http://localhost:9200/\_cat/indices?v](http://localhost:9200/_cat/indices?v)
i get lot of indices related to winlogbeats.
What should i do next
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 9:05am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/8 "2018-12-12T09:05:36Z")
Which version of Elasticsearch and Kibana are you using?
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 12, 2018, 9:15am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/9 "2018-12-12T09:15:44Z")
I am using 6.5.1 in local system/dev environment(above screenshot is from this)
But in Production we are using ES/Kibana 4.5
One additional ques(in production we are thinking of upgrading to Kibina 6.5.1 . Is is also necessary to update ES
OR
the old 4.5 ES which we have will work fine with new kibana)
Thanks
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 9:22am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/10 "2018-12-12T09:22:12Z")
Elasticsearch and Kibana need to be the same version, so upgrading to version 6.5.3 across the board would be the way to go. I also do not think recent versions of Beats are compatible with such old Elasticsearch and Kibana versions. Please see the [support matrix](https://www.elastic.co/support/matrix#matrix_compatibility) for further details.
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 12, 2018, 9:24am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/11 "2018-12-12T09:24:29Z")
Christian
Sure in production we will upgrade
But can you please suggest what to do next for kibana6.5.1 for deletion of documents in indices that are more than 30 days old
(since i have latest ES and Kibana-6.5.1 in my local system)
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 9:32am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/12 "2018-12-12T09:32:24Z")
I would recommend using [Curator](https://www.elastic.co/guide/en/elasticsearch/client/curator/5.6/cli.html) to delete indices older than a threshold.
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 12, 2018, 9:34am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/13 "2018-12-12T09:34:52Z")
Currently i have 3 indices metricbeat,filebeat,winlogbeat
Curator deletes the entire index , but i don't want to delete the entire index.
Only the records/documents older than 30 days in each index needs to be deleted.
Or can we create monthy indices and delete the index themselves every month(need help how can we do this)
Also to install curator we need pip commands .. are they supported in windows ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 9:40am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/14 "2018-12-12T09:40:13Z")
The you need to use the [delete by query API](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/docs-delete-by-query.html), which is a lot less efficient. I would recommend switching to time-based (not necessarily daily) indices and use Curator instead.
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 12, 2018, 9:42am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/15 "2018-12-12T09:42:44Z")
Did the above screenshot which i pasted contain time-based indices ?
I am new to ES . Would be really thankful if you can explain in detail how to do that via
time-based indices and curator .
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 9:43am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/16 "2018-12-12T09:43:54Z")
Yes, it does. There is an index per day as you can see in the index name. They are however very small, so you may benefit from switching to monthly indices instead.
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 12, 2018, 9:48am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/17 "2018-12-12T09:48:16Z")
Can you tell How can i create monthly indices
I cant find any option to make monthly time based index
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 12, 2018, 10:18am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/19 "2018-12-12T10:18:33Z")
You do that by specifying a monthly pattern in your Beats/Logstash config. It is the clients that determine which index they write to.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [December 12, 2018, 5:29pm UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/20 "2018-12-12T17:29:12Z")
Read [this](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and specifically the "Also be patient" part.
It's fine to answer on your own thread after 2 or 3 days (not including weekends) if you don't have an answer.
---
### Author:  [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)
#### Post date: [December 13, 2018, 7:46am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/21 "2018-12-13T07:46:40Z")
Can to please guide what config changes to be made to yml file of beats to specify the monthly index patten
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 13, 2018, 7:56am UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041/22 "2018-12-13T07:56:10Z")
Have a look at [the example in the docs](https://www.elastic.co/guide/en/beats/filebeat/6.5/elasticsearch-output.html). Just change `index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"` to `index: "filebeat-%{[beat.version]}-%{+yyyy.MM}"`.
[Next page](https://discuss.elastic.co/t/automatically-delete-1-month-old-records-documents-without-deleting-index-in-elastic-search-kibana/160041.md?page=2)