Curator, delete some data from within index

Elastic Stack Elasticsearch
1

Hello, i want to delete some rows older that 10 days from my index with Elastic Curator with the following action

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 10 days based on apps-logs indices
    options:
      ignore_empty_list: True
      disable_action: True
    filters:
    - filtertype: pattern
      kind: prefix
      value: apps-logs
    - filtertype: age
      source: creation_date
      unit: days
      unit_count: 10
      direction: older

result : it delete the index

I want to know if it is possible to delete just certain rows from the index

Thank's

2

Curator does every action at the index level. In order to delete at the document level, you will need to research delete_by_query.

3

Thank's for your answer.
If i understand that you say, i will do reseearch about older documents and delete it with kibana API or with curl request ??

4

Yes. You will need to use Kibana Console, or curl, or some other means of making an API call to issue a delete_by_query.

As a relevant aside, if your data is time-series (like logs, or other timestamp + data documents), then delete_by_query is not likely the best approach. Using individual indices that contain intervals of time-series documents is a better approach. Curator can handle these situations.

papebadiane (Pape BADIANE) 5

:+1: