# Delete logs in ElasticSearch after certain period **URL:** \ **Category:** Elasticsearch\ **Created:** [February 14, 2017, 3:22pm UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067 "2017-02-14T15:22:15Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![bob-bza](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@bob-bza](https://discuss.elastic.co/u/bob-bza)\ **Post date:** [February 16, 2017, 9:34pm UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067/22 "2017-02-16T21:34:24Z")
> [@theuntergeek](#): > > No, it doesn't. can i know the reason please!!! ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [February 16, 2017, 9:37pm UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067/23 "2017-02-16T21:37:32Z")
Curator _always_ uses the same API calls, regardless of whether it's deployed locally or remotely. AWS ES does not respond with the proper data, so Curator simply won't work with it. ---
**Author:** ![bob-bza](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@bob-bza](https://discuss.elastic.co/u/bob-bza)\ **Post date:** [February 17, 2017, 1:29am UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067/24 "2017-02-17T01:29:28Z")
> [@theuntergeek](#): > > Curator always uses the same API calls, regardless of whether it's deployed locally or remotely. AWS ES does not respond with the proper data, so Curator simply won't work with it. thanks . By using "curl -X DELETE" how can i specify target age. can you please direct me to proper documentation/page . ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [February 17, 2017, 2:02am UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067/25 "2017-02-17T02:02:47Z")
You will have to script it with some other tool: bash, or some other shell; or perhaps some other program someone has written. ---
**Author:** ![godber](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/godber/32/13257_2.png) [@godber](https://discuss.elastic.co/u/godber)\ **Post date:** [February 17, 2017, 12:00pm UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067/26 "2017-02-17T12:00:32Z")
@bob-bza, the thing that wasn't explicitly said here is that the way people handle data "curation" like this relies on two things: 1. Logs should be placed in a "daily" index with names like "logs-2017-01-16", "logs-2017-01-17" through "logs-2017-02-17". 2. You somehow delete the indices that fall outside of your retention period. Using "curl" to delete a whole index is just fine. So, today you might delete "logs-2017-01-16". If you put all of your logs into the same index, then you have to go through find individual entries by timestamp and delete them. This is a much harder task. See the note at the bottom of the page here: [https://www.elastic.co/guide/en/elasticsearch/reference/current/\_deleting\_documents.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/_deleting_documents.html) > See the [Delete By Query API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html) to delete all documents matching a specific query. It is worth noting that it is much more efficient to delete a whole index instead of deleting all documents with the Delete By Query API." But like @theuntergeek says, you don't want to delete by query. - Austin ---
**Author:** ![bob-bza](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@bob-bza](https://discuss.elastic.co/u/bob-bza)\ **Post date:** [February 17, 2017, 2:33pm UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067/27 "2017-02-17T14:33:31Z")
> [@godber](#): > > Logs should be placed in a "daily" index with names like "logs-2017-01-16", "logs-2017-01-17" through "logs-2017-02-17". > You somehow delete the indices that fall outside of your retention period. Using "curl" to delete a whole index is just fine. So, today you might delete "logs-2017-01-16". i was writing around 30-40 types of different indexes to ES, so its hard for us to create indexes in kibana with - all the time. is there any other solution for indexs to view in kibana. then i can go with approch - that will be easy for us to delete logs ---
**Author:** ![bhatch](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@bhatch](https://discuss.elastic.co/u/bhatch)\ **Post date:** [February 20, 2017, 9:44pm UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067/28 "2017-02-20T21:44:50Z")
I'm not quite sure I understand your last question. When it comes to Kibana it shouldn't really matter whether you use daily indices or one giant index. For example lets say you have these daily indices: eventlogs-2017.02.20 eventlogs-2017.02.19 eventlogs-2017.02.18 syslogs-2017.02.20 syslogs-2017.02.19 syslogs-2017.02.18 In kibana you setup an index pattern of: eventlogs-\* syslogs-\*. The \* is a wildcard. Kibana will automatically match every index that matches that pattern. So whether that pattern matches 1 index or 100 indexes, there is no extra overhead for you. Once you setup the initial pattern you never have to go back and add new patterns. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 20, 2017, 9:46pm UTC](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067/29 "2017-03-20T21:46:02Z")
Closed on March 20, 2017, 9:46pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/delete-logs-in-elasticsearch-after-certain-period/75067.md?page=1)