# Delete old data from Elasticsearch

**URL:** <https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660>\
**Category:** Elasticsearch\
**Created:** [December 12, 2016, 5:04am UTC](https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660 "2016-12-12T05:04:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![siddharth.browntape](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@siddharth.browntape](https://discuss.elastic.co/u/siddharth.browntape)\
**Post date:** [December 12, 2016, 5:04am UTC](https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660/1 "2016-12-12T05:04:31Z")

</div>

Hi,

How to delete elasticsearch data which is older than 30 days from an Index. I have an Index and data keep on coming on daily basis , my requirement is to delete old data from this index to make more disk space .

What is the best option to achieve this?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 12, 2016, 5:06am UTC](https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660/2 "2016-12-12T05:06:27Z")

</div>

The best option is to use time based indices, then you can simply delete the index with [Elasticsearch Curator](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/index.html).

Without that you need to use delete-by-query, which is expensive.

---

<div class="post-metadata">

**Author:** ![Srinivas\_Mangipudi](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@Srinivas\_Mangipudi](https://discuss.elastic.co/u/Srinivas_Mangipudi)\
**Post date:** [December 12, 2016, 5:24am UTC](https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660/3 "2016-12-12T05:24:38Z")

</div>

Hi Mark,

Say I create monthly time-based indices, and delete the last month's index using curator. But when my index will switch to the latest month, I will not have any data on the first day. Is there some way or architecting that whenever my index switches I will atleast have 7 days worth of data to start with.

One way I am assuming could be duplicating data and start writing to both indices before 7 days the current index is about to expire.

Are there better ways to do this? Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 12, 2016, 5:25am UTC](https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660/4 "2016-12-12T05:25:23Z")

</div>

Use weekly indices then.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 12, 2016, 5:27am UTC](https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660/5 "2016-12-12T05:27:23Z")

</div>

Create daily indices and every day drop the index which has aged beyond 30 days.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [December 12, 2016, 12:57pm UTC](https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660/6 "2016-12-12T12:57:24Z")

</div>

Curator does not have to use a time stamp in the index name. It can use the `creation_date` or deterministically by testing the min or max time stamp values in the indices with the field\_stats API. You could easily write filters for Curator to keep monthly index data until 7 days after a new month rolls over.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2017, 12:57pm UTC](https://discuss.elastic.co/t/delete-old-data-from-elasticsearch/68660/7 "2017-01-09T12:57:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
