# Delete old back indexes from alias **URL:** \ **Category:** Elasticsearch\ **Created:** [September 6, 2023, 11:38am UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439 "2023-09-06T11:38:20Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![kmz161](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Post date:** [September 6, 2023, 11:38am UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/1 "2023-09-06T11:38:20Z")
Hello! I use data streams for store data. And I have data stream alias. How I can automatically delete back indexes older 7 days from alias? ---
**Author:** ![miltonhultgren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miltonhultgren/32/100401_2.png) [@miltonhultgren](https://discuss.elastic.co/u/miltonhultgren)\ **Post date:** [September 6, 2023, 11:46am UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/2 "2023-09-06T11:46:21Z")
Please have a look at using [ILM policies](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html) to automate this! ---
**Author:** ![kmz161](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Post date:** [September 6, 2023, 11:48am UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/3 "2023-09-06T11:48:16Z")
I need save index, but It must be removed from alias ---
**Author:** ![miltonhultgren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miltonhultgren/32/100401_2.png) [@miltonhultgren](https://discuss.elastic.co/u/miltonhultgren)\ **Post date:** [September 6, 2023, 12:30pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/4 "2023-09-06T12:30:02Z")
Can you explain a bit more about what you're trying to achieve? Can this be solved by using a `ranger` filter instead, to limit your searches to the data from the last 7 days (regardless of which index they live in behind the alias)? ---
**Author:** ![kmz161](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Post date:** [September 6, 2023, 12:37pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/5 "2023-09-06T12:37:59Z")
I use alias for SIEM rules. And now indices have dynamic mappings. Sometimes there are Siem rules errors occur due to mapping conflicts. Now I solve this problem by changing the data stream name and adding it to alias. But I need alias consists only last backing data stream index. P.S. I know that strict mapping is the best decision. Gradually I use it ---
**Author:** ![miltonhultgren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miltonhultgren/32/100401_2.png) [@miltonhultgren](https://discuss.elastic.co/u/miltonhultgren)\ **Post date:** [September 6, 2023, 1:14pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/6 "2023-09-06T13:14:49Z")
Right, so you have a SIEM rule looking at data from the last 7 days. Due to the mapping change you now have some indices with one mapping, and the newer ones have a different mapping causing the conflict when the rule runes since the rule looks at both type of indices and the mappings conflict. So rather than waiting for 7 days for the old indices to move out of the look back window of the rule, you want to remove those old indices from the alias? The risk of doing that is that your rule won't be looking at that data anymore (defeating the point of the look back window you set). If that's okay for you, isn't it possible to simply [remove the alias](https://www.elastic.co/guide/en/elasticsearch/reference/current/aliases.html#remove-alias) for those old indices? Another option might be to [re-index](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html) those old indices so they get the new mappings. ---
**Author:** ![kmz161](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Post date:** [September 6, 2023, 2:33pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/7 "2023-09-06T14:33:50Z")
Unfortunately, I can't remove separate back index from alias. I only can remove full data stream. And I can't reindex old data because it will cause cluster overload. Therefore, I want to automatically delete indexes older than a 7 days ---
**Author:** ![miltonhultgren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miltonhultgren/32/100401_2.png) [@miltonhultgren](https://discuss.elastic.co/u/miltonhultgren)\ **Post date:** [September 6, 2023, 2:50pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/8 "2023-09-06T14:50:30Z")
For this particular case, would it be enough to only delete the indices that are within the last 7 days which have the old mapping? That should make the SIEM rule work going forward. ---
**Author:** ![kmz161](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Post date:** [September 6, 2023, 3:04pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/9 "2023-09-06T15:04:10Z")
> [@miltonhultgren](#): > > For this particular case, would it be enough to only delete the indices that are within the last 7 days which have the old mapping? > That should make the SIEM rule work going forward. I need save index, but remove from alias. It is good way for SIEM rules ---
**Author:** ![miltonhultgren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miltonhultgren/32/100401_2.png) [@miltonhultgren](https://discuss.elastic.co/u/miltonhultgren)\ **Post date:** [September 7, 2023, 3:01pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/10 "2023-09-07T15:01:02Z")
I got a tip from the Elasticsearch devs that there is an API to modify a data stream that would allow you to exclude the backing indices from the data stream without deleting them. > **[Modify data streams API | Elasticsearch Guide \[8.9\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/modify-data-streams-api.html)** ---
**Author:** ![kmz161](https://avatars.discourse-cdn.com/v4/letter/k/838e76/32.png) [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Post date:** [September 7, 2023, 3:18pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/12 "2023-09-07T15:18:29Z")
> [@miltonhultgren](#): > > I got a tip from the Elasticsearch devs that there is an API to modify a data stream that would allow you to exclude the backing indices from the data stream without deleting them. Нос I can automatically exclude back index? May be I can use ILM for such purpose? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 7, 2023, 5:32pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/13 "2023-09-07T17:32:45Z")
As far as I know you can not do this automatically, and likely not even with ILM as there is no appropriate action. I suspect you will need to manage this yourself externally to Elasticsearch. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 5, 2023, 5:33pm UTC](https://discuss.elastic.co/t/delete-old-back-indexes-from-alias/342439/14 "2023-10-05T17:33:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.