Delete the indexes of more than 7 days

Elastic Stack Elasticsearch
1

Hi!

I was reading this two links in order to create a policy to delete the indexes of more than 7 days.

https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/applying-policy-to-template.html#applying-policy-to-template

This is my template
GET /_template/company_template

  {
      "company_template" : {
        "order" : 0,
        "index_patterns" : [
          "gke_prod_*",
          "gke_stage_*"
        ],
        "settings" : {
          "index" : {
            "lifecycle" : {
              "name" : "company_policy"
            },
            "number_of_shards" : "1",
            "number_of_replicas" : "1"
          }
        },
        "mappings" : { },
        "aliases" : { }
      }
    }

This is my policy
GET _ilm/policy/company_policy

{
  "company_policy" : {
    "version" : 1,
    "modified_date" : "2019-08-27T11:30:21.963Z",
    "policy" : {
      "phases" : {
        "delete" : {
          "min_age" : "7d",
          "actions" : {
            "delete" : { }
          }
        }
      }
    }
  }
}

However when I go to Index Lifecycle Policies in web console I don't see any "Linked indices" :cry: and the index patern is correct.

What I do wrong or how I can debug?

I have a lot of old indexes, this policy should be apply to all indices too or only from today (for new indexes)?

Thank you

2

When I see the setting for index of today I can see this

{
  "settings": {
    "index": {
      "lifecycle": {
        "name": "company_policy"
      },
      "number_of_shards": "1",
      "provided_name": "gke_prod_aaa-2019.08.29",
      "creation_date": "1567036813104",
      "number_of_replicas": "1",
      "uuid": "cNjKnFdgTDKqlDqvgMoLMg",
      "version": {
        "created": "7030099"
      }
    }

However in my old indexes no.

{
  "settings": {
    "index": {
      "creation_date": "1566950412251",
      "number_of_shards": "1",
      "number_of_replicas": "1",
      "uuid": "eylMA44wRn6-IMMxJbltug",
      "version": {
        "created": "7030099"
      },
      "provided_name": "gke_prod_aaa-2019.08.28"
    }
  },

Thats means that only applies for the new indexes and now I won't have old indexes more than 7 days from today, but I can't applying for the old indexes?

3

Hi @David_Oceans
I recommend you to check my reply in this topic:
https://discuss.elastic.co/t/how-to-configure-my-index-life-cycle-policy/193468?u=dgonzalezp
You can skip the first step about how to create new index each day.
If you have any doubt tell me.

4

The key is this in the case before? manage_template => false ?
In my case I use filebeat, How I should to do?

But as I read in your post, I have it well configured for the new indexes, but my problem then is in those that are already created that does not apply, right?

Regards

5

You are right, in your case the indexes already created will not be apply because those didnt use the template to be created then the lifecycle doesnt affect on this ones.
Anyway you can delete those index manually using the following command:

DELETE gke_prod-aaa-2019.08.*

With that one for example you will delete all the indexes from that month.
I hope this will be useful for you.