In that specific case, you need a script to do it. Try this:
(replace USERNAME, PASSWORD and test accordingly. mind the https
, don't know if you use http or https. if you don't have username/password remove USERNAME:PASSWORD@
) Credit to @ Jenni for the script, she helped me when I had a similar issue.
curl -k -X POST "https://USERNAME:PASSWORD@localhost:9200/test/_delete_by_query?pretty" -H 'Content-Type: application/json' -d'
{
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"lt": "now-30d"
}
}
}
]
}
}
}
Althought I recommend setting up your beats to create new index every day so if you set up ILM, only old data will be removed.