Thanks for the response,
I meant the logs from the remote servers. We plan on having about 50 remote server that would ship logs to elasticsearc (for example entries from /var/log/mysqld.log on each remote machine) Those need to be removed after 3 months on the logging server.