Can Elasticsearch be configured to remove old data regularly?


I am using Elasticsearch 2.4.1, and have Logstash 2.4.1 and Heapster 1.2.0 to send logs and performance metrics to Elasticsearch, my index are like this:

$ curl
health status index pri rep docs.count docs.deleted store.size
green open logstash-2017.01.03 1 0 622530 0 399.6mb 399.6mb
green open logstash-2017.01.04 1 0 64176 0 40.2mb 40.2mb
green open heapster 1 0 408956 0 62.2mb 62.2mb

Logstash and Heapster will send a lot of data to Elasticsearch every day. So I am wondering if Elasticsearch can be configured to remove oldest data regularly, e.g., only keep the data of the last 1 day or 1 week.


The usual way to do this is to cron curator to run at some time that is convenient to you.

Thanks Nik!

It seems Curator has it own release versions, like: 4.0, 4.1, 4.2. Can you please let me know which one is best for Elasticsearch 2.4.1?

Curator v4 works with any Elasticsearch version 2.x or 5.0 & 5.1

See the compatibility matrix at

Got it, thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.