Deleting data


(octomeow-2) #1

I have a very simple graylog2 set up using elasticsearch running
happily

I want to know how to expire data, say logs older than 6 months. The
delete
query api seems to allow delete, but only by type or user, and not by
age?

Could someone kindly point me in the right direction? Thanks.


(Eric Jain) #2

On Apr 17, 8:53 am, octomeow octom...@gmail.com wrote:

I want to know how to expire data, say logs older than 6 months. The
delete
query api seems to allow delete, but only by type or user, and not by
age?

You should be able to use any query to delete documents?

http://www.elasticsearch.org/guide/reference/api/delete-by-query.html


(Marcin Dojwa) #3

As I remember you can set ttl to each document. You can find it on
elasticsearch.org pages, currently I can not check where exactly. I will
check it tomorrow if you don't find it till then.

W dniu wtorek, 17 kwietnia 2012 użytkownik Eric Jain napisał:

On Apr 17, 8:53 am, octomeow <octom...@gmail.com <javascript:;>> wrote:

I want to know how to expire data, say logs older than 6 months. The
delete
query api seems to allow delete, but only by type or user, and not by
age?

You should be able to use any query to delete documents?

http://www.elasticsearch.org/guide/reference/api/delete-by-query.html


(Radu Gheorghe) #4

I think this is what you're talking about:
http://www.elasticsearch.org/guide/reference/mapping/ttl-field.html

On Apr 17, 10:59 pm, Marcin Dojwa m.do...@livechatinc.com wrote:

As I remember you can set ttl to each document. You can find it on
elasticsearch.org pages, currently I can not check where exactly. I will
check it tomorrow if you don't find it till then.

W dniu wtorek, 17 kwietnia 2012 użytkownik Eric Jain napisał:

On Apr 17, 8:53 am, octomeow <octom...@gmail.com <javascript:;>> wrote:

I want to know how to expire data, say logs older than 6 months. The
delete
query api seems to allow delete, but only by type or user, and not by
age?

You should be able to use any query to delete documents?

http://www.elasticsearch.org/guide/reference/api/delete-by-query.html


(Marcin Dojwa) #5

Exactly, this is what I was talking about.

W dniu 18 kwietnia 2012 09:33 użytkownik Radu Gheorghe <
radu0gheorghe@gmail.com> napisał:

I think this is what you're talking about:
http://www.elasticsearch.org/guide/reference/mapping/ttl-field.html

On Apr 17, 10:59 pm, Marcin Dojwa m.do...@livechatinc.com wrote:

As I remember you can set ttl to each document. You can find it on
elasticsearch.org pages, currently I can not check where exactly. I will
check it tomorrow if you don't find it till then.

W dniu wtorek, 17 kwietnia 2012 użytkownik Eric Jain napisał:

On Apr 17, 8:53 am, octomeow <octom...@gmail.com <javascript:;>>
wrote:

I want to know how to expire data, say logs older than 6 months. The
delete
query api seems to allow delete, but only by type or user, and not by
age?

You should be able to use any query to delete documents?

http://www.elasticsearch.org/guide/reference/api/delete-by-query.html


(system) #6