Can I delete monitoring and logging indexes?

Elastic Search
1

As I mentioned in my previous post (AppSearch disk consumption keeps growing), my EES+ES node is quickly filling up the disk, even my document count and size is pretty stable

Kibana shows me that my most heavy indexes are
.monitoring-es-7-2020-XX-XX : 700MB each.
.ent-search-api-ecs-logs-togo_production-7.6.0-2020-XX-XX: also 700MB each
.ent-search-app-search-analytics-ecs-logs-togo_production-7.6.0-2020-XX-XX: 200MB each

I don't use any of the analytics features in appsearch.
Can I delete or make some operation in order to reduce their size?
In my last post my HD was 12GB, now it's 50GB!

2

You can disable montioring: https://www.elastic.co/guide/en/elasticsearch/reference/current/monitoring-settings.html and delte that index. But actually the index should delete itself automatically after 7 days.

3

Thank you @defalt
That setting affects only the monitoring indexes, which indeed have a retention of 7 days. However, it doesn't affect all the ent-search-* indexes, which are never deleted

4

Hey @gpribi,

In general, our current recommendation is to use https://github.com/elastic/curator to deal with these large indexes.

Jason

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.