Delete documents in index alias

Elastic Stack Elasticsearch
1

Hello everyone!

Supose that i create one index per month but i create one alias for this index per day filtering by a timestamp field referencing the current day.

Can i performe a DELETE operation on the index alias to delete just the documents belongs that day/index alias?

It works?

2

Short answer, no. If an alias is pointing at an index, a delete operation will hit the entire index.

You have two options, as I see it:

  1. Use the delete_by_query plugin
  2. Actually use daily indices with the rollover API or some such and delete the rolled-over indices with Curator, or some other script.
3

Thank you for your answer @theuntergeek!

Actually i am currently using daily indexes but because i am creating a index per application per day (i am indexing application logs) my number of shards is too high and it are costing too memory of my cluster.

I am wondering how to reduce the number of shards without change my busines rules and i think i could use index aliases with filter, but not.

4

That's an easier answer (or two):

  1. Create an alias pointing to a rollover-friendly index.
  2. Use Curator to rollover your indices when they hit a certain document count.

This will enable you to reduce shard count by allowing indices to build in size, but only until they are a set number of documents.

Option 2 (which can conceivably be combined with option 1):

Use Curator's reindex action to periodically reindex multiple older daily indices to a single weekly (or monthly) index with a smaller shard count.

Option 3 (which is coming to Curator in a future release):

Use the Shrink API to reduce shards.

5

Thank you!

I'll try these options.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.