Compress Elasticsearch Index after x days

Elastic Stack Elasticsearch
#1

Hi All,

I'm using ELK version 6.5.8. Using curator retention period of ES index are maintaining i.e. 7 days. Here is a requirement where I want to keep 3 days data in index & data more than 3 days should compress & got delete after 7 days.

using index.codec: best_compression in elasticsearch.yml file will compress all the data of index.

Need help how to compress data that is more than 3 days old.

Thanks.

#2

Index Lifecycle Management feature is built for that.

#3

You can't use that. It's an index level settings that can not be defined in elasticsearch.yml.

This is a too old version. You need to upgrade at least to 6.8 or better 7.12.

#4

Thanks @dadoonet Points are taken. Let me test on upgraded version.