Delete index automatically after particular days

Elastic Stack Elasticsearch
1

Hi,

I am using Logstash to ingest log data to elasticsearch, Indices are created daily, that every day's index has a unique name like index_name-YYYY-MM-DD. So, after 30 days, there will be 30 indices. On day 31st, I want the index made at day 1 to get deleted, and on 32nd day, I want 2nd day's index to get deleted.

I had a look at Index Lifecycle Policies. I will be having just Hot indices and no other life cycle category. I created the below CURLs.

curl -X PUT "localhost:9200/_ilm/policy/delete_policy?pretty" -H 'Content-Type: application/json' -d'
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age": "30d"
          }
        }
      }
    }
  }
}
'

curl -X PUT "localhost:9200/mylogs*/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index": {
    "lifecycle": {
      "name": "delete_policy"
    }
  }
}
'

Is it alright to proceed with this? Will this give me what I am looking for? Is there any change needed / suggested?

Thanks.

2

Hi,

No, this will NOT do what you want. This will create indizes each having the data of 30 days. You want to have a hot phase with a daily rollover and a delete phase, like(untested):

curl -X PUT "localhost:9200/_ilm/policy/delete_policy?pretty" -H 'Content-Type: application/json' -d'
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age": "1d"
          }
        }
      },
        "delete" : {
          "min_age" : "30d",
          "actions" : {
            "delete" : { }
          }
        }
    }
  }
}
'

Best regards
Wolfram

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.