Delete indices after 180 days

[secsec]

Hello,

i have create new ILM policy

PUT _ilm/policy/delete-logs-after-6months
{
  "policy": {
    "phases": {
      "delete": {
        "min_age": "180d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

and created index template and map to ILM policy

PUT /_index_template/template_delete-logs-after-6months
{
  "index_patterns": ["linux-*"],
  "template": {
    "settings": {
      "index": {
        "lifecycle": {
          "name": "delete-logs-after-6months"
        }
      }
    }
  }
}

this my logstash output

output {
    if [host][os][type] == "windows" {
        elasticsearch {
            hosts => "https://somedomain.cz:9200"
            ssl_enabled => true
            ssl_key => "some.key"
            ssl_certificate => "certificate.crt"
            user => 'elastic'
            password => 'somepass'
            ssl_certificate_authorities => "ca.crt"
            manage_template => true
            template_name => "template_delete-logs-after-6months"
            index => "windows-%{[host][name]}-%{+YYYY.MM.dd}"
        }
    } else if [host][os][type] == "linux" {
        elasticsearch {
            hosts => "https://somedomain.cz:9200"
            user => 'elastic'
            password => 'somepass'
            ssl_enabled => true
            ssl_key => "some.key"
            ssl_certificate => "certificate.crt"
            ssl_certificate_authorities => "ca.crt"
            manage_template => true
            template_name => "template_delete-logs-after-6months"
            index => "linux-%{[host][name]}-%{+YYYY.MM.dd}"
        }
    } else {
        elasticsearch {
            hosts => "https://somedomain.cz:9200"
            user => 'elastic'
            password => 'somepass'
            data_stream => true
            ssl_enabled => true
            ssl_key => "some.key"
            ssl_certificate => "certificate.crt"
            ssl_certificate_authorities => "ca.crt"
        }
    }
}

creating new indexes are working but all created indexes are not mapped to "template_delete-logs-after-6months"

how can i make sure that those templates new will be deleted after 6 months please?

im playing with values but no luck

manage_template => true
template_name => "template_delete-logs-after-6months"

and using Elastic 8.11

many thanks

[carly.richmond]

Hi @secsec,

I assume you're not seeing any errors with ILM at all, simialr to these in the troubleshooting guide? Have you tried using the _explain API to investigate the ILM settings on the impacted indexes?

[yago82]

hi,

for those previously existing indexes:

Go to the Index Management section in your Elasticsearch interface.
Select the index that needs to adhere to the new lifecycle policy.
Find the "Add lifecycle policy" option and apply the desired policy (template_delete-logs-after-6months in your case) to ensure these indexes comply with the specified deletion timeframe.