We are running, Logstash, Elastic Search and Kibana all on the same server. We use it to review log/alert data. We only care about the last 7 days worth of data. As our hard disk is starting to fill up I'd like to delete older data.
I have followed the docs to list all the Index. They are all of the form logstash-2015.mm.dd.
I have been able to delete the older Indices using this method:
curl -XDELETE 'localhost:9200/logstash-2015.05.1*?pretty'
And also using Curator
I can see that the indices have been deleted. But I don't have any more free disk space, can somebody explain?