Delete document from index based on log type

Elastic Stack Elasticsearch
1

Hello ES users,
I am trying to explore an option to delete certain type of logs from ES index without deleting the whole index. For example, DEBUG type logs doesn't need to be retained for longer period compared to INFO type logs. Is it possible to delete specific type of logs from an index?

Thanks,
SRK.

2

Yes, you can do this by using delete by query. This is however quite expensive so you would be better off grouping data into indices based on retention requirements so you can delete complete indices instead.

3

Hi, can you please point me to the documentation for deleting by query and you mean resource, time expensive? Can you also explain a bit about the second option?

Thanks,
SRK.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.