Can Elasticsearch be configured to remove old data regularly?

Elastic Stack Elasticsearch
1

Hi,

I am using Elasticsearch 2.4.1, and have Logstash 2.4.1 and Heapster 1.2.0 to send logs and performance metrics to Elasticsearch, my index are like this:

$ curl 127.0.0.1:9200/_cat/indices?v
health status index pri rep docs.count docs.deleted store.size pri.store.size
green open logstash-2017.01.03 1 0 622530 0 399.6mb 399.6mb
green open logstash-2017.01.04 1 0 64176 0 40.2mb 40.2mb
green open heapster 1 0 408956 0 62.2mb 62.2mb

Logstash and Heapster will send a lot of data to Elasticsearch every day. So I am wondering if Elasticsearch can be configured to remove oldest data regularly, e.g., only keep the data of the last 1 day or 1 week.

Thanks,
Qian

2

The usual way to do this is to cron curator to run at some time that is convenient to you.

3

Thanks Nik!

It seems Curator has it own release versions, like: 4.0, 4.1, 4.2. Can you please let me know which one is best for Elasticsearch 2.4.1?

4

Curator v4 works with any Elasticsearch version 2.x or 5.0 & 5.1

See the compatibility matrix at https://github.com/elastic/curator

5

Got it, thanks!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.