Hello. I am new to ELK. I have managed to install and setup ELK 7.6.2 stack on RHEL 7 servers. Now as part of house keeping I need to remove/ delete indices older than 30 days to maintain certain level of available disk space.
Can I do this using Kibana console by navigating through the following:
Management => Index Lifecycle policies => Create an index lifecycle policy => Delete phase => Activate delete phase => 30 days from rollover
Are there any disadvantages of using the above?
Please note that I want to avoid using Curator (Read about it in this forum)
Hello Dan. Thanks for a detailed reply. I have a few questions as follows:
I have 3 master nodes and 5 data nodes configured. There are three steps provided by you above for creating policy, assigning policy and creating template. Can I paste these one by one in the "Dev Tools" in Kibana and execute? Would it apply to the entire cluster?
Names of all my index patterns start with "prod_xxxx". When following your proposed Step 2 shall I replace:
PUT /index_name-*/_settings?pretty
with
PUT /prod_*/_settings?pretty
Likewise in following your Step 3 above can I replace as follows:
Ad.1 In my opinion you can connect to one node only and execute these three steps there. In addition. In my environment I have 3 master nodes configured. My Kibana connect to all nodes because Kibana setting looks like:
If I good remember the template is used in case of new indexes, ie. when a new index is created in Elasticsearch, then your deletion policy will be assigned to it.
In step 2 your new deletion policy will be assigned to existing indexes in Elasticsearch only.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.