Delete host specific index data


(Prasad Lele) #1

Hi,

We have setup elasticsearch + logstash. The log stash collects data from
various firewalls/Linux servers etc. I do not need firewall's info logs
older than 7 days, but still need logs above that (critical, warning etc).
Is there any way that I can delete specific in logs from the index or say
logs of specific host(firewall/Server) from the indexes

Regards
Prasad Lele

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/4e9f82b7-7abc-4d0e-a859-c0fe95097e1b%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Johan Rask) #2

Take a look att this page for more info.
http://www.elasticsearch.org/tutorials/using-elasticsearch-for-logs/

Basically it says that you should manage your logs so you can delete
complete indices and deleting
lots of documents from an index is not recommendend.

If you still want to try =>

: You can delete by query.
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/docs-delete-by-query.html
However, read the warning saying not to delete large bulks"

: Set time-to-live
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-ttl-field.html

Regards /johan

Den torsdagen den 23:e januari 2014 kl. 09:14:54 UTC+1 skrev Prasad Lele:

Hi,

We have setup elasticsearch + logstash. The log stash collects data from
various firewalls/Linux servers etc. I do not need firewall's info logs
older than 7 days, but still need logs above that (critical, warning etc).
Is there any way that I can delete specific in logs from the index or say
logs of specific host(firewall/Server) from the indexes

Regards
Prasad Lele

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8c778364-7ddc-41cf-b3cb-d277c74fb15c%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(system) #3