Can Elasticsearch be configured to remove old data regularly?

(Qian Zhang) #1


I am using Elasticsearch 2.4.1, and have Logstash 2.4.1 and Heapster 1.2.0 to send logs and performance metrics to Elasticsearch, my index are like this:

$ curl
health status index pri rep docs.count docs.deleted store.size
green open logstash-2017.01.03 1 0 622530 0 399.6mb 399.6mb
green open logstash-2017.01.04 1 0 64176 0 40.2mb 40.2mb
green open heapster 1 0 408956 0 62.2mb 62.2mb

Logstash and Heapster will send a lot of data to Elasticsearch every day. So I am wondering if Elasticsearch can be configured to remove oldest data regularly, e.g., only keep the data of the last 1 day or 1 week.


(Nik Everett) #2

The usual way to do this is to cron curator to run at some time that is convenient to you.

(Qian Zhang) #3

Thanks Nik!

It seems Curator has it own release versions, like: 4.0, 4.1, 4.2. Can you please let me know which one is best for Elasticsearch 2.4.1?

(Aaron Mildenstein) #4

Curator v4 works with any Elasticsearch version 2.x or 5.0 & 5.1

See the compatibility matrix at

(Qian Zhang) #5

Got it, thanks!

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.