# Deleting indices older than 90 days **URL:** \ **Category:** Elasticsearch\ **Created:** [March 7, 2018, 3:55am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811 "2018-03-07T03:55:45Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 7, 2018, 3:55am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/1 "2018-03-07T03:55:45Z")
Hi i am trying to delete indices older than 90 days. My elastic search index pattern is indexname-%Y.%m in this case it is applicationlogs-2017-12 Below is my action.yml actions: 1: action: delete\_indices description: \>- Delete applicationlogs indices older than given days options: ignore\_empty\_list: True filters: - filtertype: pattern kind: prefix value: applicationlogs- - filtertype: age source: name direction: older timestring: '%Y.%m' unit: days unit\_count: 90 It is deleting the indices not by days month wise. If i am having indices as applicationlogs-2017-11 applicationlogs-2017-12 applicationlogs-2018-01 applicationlogs-2018-02 action.yml is deleting november month full indices [From 1st november to 30 november]. This behavior Is because i am having only month in the index? Please need some pointers. I am using curator, version 5.4.1 ---
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [March 7, 2018, 5:33am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/2 "2018-03-07T05:33:01Z")
maybe you can try to change the `unit: days` to `unit: months`, and change `unit_count: 90` to `unit_count: 3`. ---
**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\ **Post date:** [March 7, 2018, 6:12am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/3 "2018-03-07T06:12:27Z")
curator works only on index level not on document level so curator can **not** delete documents within an index [https://www.elastic.co/guide/en/elasticsearch/client/curator/current/about-features.html](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/about-features.html) ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 7, 2018, 6:42am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/4 "2018-03-07T06:42:30Z")
> [@shivu](#): > > kind: prefix can use > kind: regex > source: creation\_date ---
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 7, 2018, 8:53am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/5 "2018-03-07T08:53:03Z")
Thanks for the reply. Still it is deleting full month data. Example if 90 days are getting over on January 10 from today ideally it should delete from 10 and old data but here it is deleting full January month data too. ---
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 7, 2018, 8:54am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/6 "2018-03-07T08:54:05Z")
Thanks for the reply. But still it is deleting full month data. May be it is because we are creating index based on month. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 7, 2018, 8:57am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/7 "2018-03-07T08:57:30Z")
as this. use --dry-run test which indices delete . kind: prefix this can do many.. you can try . ---
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 7, 2018, 9:02am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/8 "2018-03-07T09:02:29Z")
In dry run giving following results when i do --dry-dun 08:53:31,412 INFO Preparing Action ID: 1, "delete\_indices" 08:53:31,419 INFO Trying Action ID: 1, "delete\_indices": Delete inforlogs indices older than given days 08:53:31,586 INFO DRY-RUN MODE. No changes will be made. 08:53:31,586 INFO (CLOSED) indices may be shown that may not be acted on by action "delete\_indices". 08:53:31,587 INFO DRY-RUN: delete\_indices: applicationlogs-2018.01 with arguments: {} 08:53:31,587 INFO Action ID: 1, "delete\_indices" completed. 08:53:31,587 INFO Job completed. As per logs it is deleting January month full data. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 7, 2018, 9:05am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/9 "2018-03-07T09:05:45Z")
> [@shivu](#): > > applicationlogs-2018.01 this delete only applicationlogs-2018.01 is not ok?? you can create crontab running moths. not ok? ---
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 7, 2018, 9:11am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/10 "2018-03-07T09:11:18Z")
Yes, i am also cron job for deletion. If today my cron runs and it checks for 90 days it will be middle of the month for example if 90 days is January 5th, the it should not delete January 6th logs but in this case it is deleting. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 7, 2018, 9:12am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/11 "2018-03-07T09:12:15Z")
it about **indices** not **docs** as i know.. ---
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 7, 2018, 9:14am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/12 "2018-03-07T09:14:31Z")
Oh ok. Then can i find 6th January document in the elastic search. If yes how can i see? I am new to elasticsearch. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 7, 2018, 9:14am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/13 "2018-03-07T09:14:52Z")
if as days . you can change the indices to applicationlogs-2018.01.xx ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 7, 2018, 9:15am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/14 "2018-03-07T09:15:44Z")
use kibana see the data is better. ---
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 7, 2018, 9:17am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/15 "2018-03-07T09:17:12Z")
Yes we have Kibana as log viewer when i delete January index not able to see in the Kibana ui for January . ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [March 7, 2018, 1:51pm UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/16 "2018-03-07T13:51:35Z")
I think the problem you are encountering is that is that Curator is only looking to see if the index date, as indicated by the time string in the index name, is older than 90 days _from the moment of execution._ Here's a little python code to show you what's happening under the hood in Curator: ```auto $ python3 Python 3.6.3 (default, Oct 9 2017, 12:04:21) [GCC 4.2.1 Compatible Apple LLVM 9.0.0 (clang-900.0.37)] on darwin Type "help", "copyright", "credits" or "license" for more information. >>> from datetime import datetime, timedelta >>> datetime.utcnow() datetime.datetime(2018, 3, 7, 13, 44, 53, 139826) >>> datetime.utcnow()-timedelta(days=90) datetime.datetime(2017, 12, 7, 13, 44, 58, 401248) >>> (datetime.utcnow()-timedelta(days=90)).strftime('%Y.%m.%d') '2017.12.07' ``` So, what you see here is that similar to Curator, I'm using `utc` time, and that 90 days go from right this moment in UTC time is December 7, 2017. Since the rest of the month of December is not yet older than 90 days, Curator will not delete the index `applicationlogs-2017-12`. With the configuration you provided, Curator will not delete an index until every day of the index (you specified monthly indices) is older than 90 days. Do you still want Curator to delete `applicationlogs-2017-12` even though the dates of December 1-7 are all that are older than 90 days? We can discuss alternate configurations which can achieve something like this if you are interested. ---
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 8, 2018, 5:20am UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/17 "2018-03-08T05:20:18Z")
Thank you for the reply, I dont want to delete full december month data if 90 days over on december 7th it should delete from 7th and it's previous data, but in my case it is deleting full december month data. When i saw from kibana i am not able to see december month data. If any options to achieve day wise delete let me know i will try. ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [March 8, 2018, 3:23pm UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/18 "2018-03-08T15:23:24Z")
As has been previously mentioned, you cannot use Curator to delete data _from_ an index. It can only delete entire indices. You should _never_ delete data from an index unnecessarily, especially when it is time series data. Deleting entire indices is the appropriate method for data clean up. If you need to delete older data, you should consider daily or weekly indices, and then your retention will be more exact than monthly. ---
**Author:** ![shivu](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@shivu](https://discuss.elastic.co/u/shivu)\ **Post date:** [March 8, 2018, 4:27pm UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/19 "2018-03-08T16:27:15Z")
Thank you for the clarification. Now understood fully. We will make changes as per your suggestion. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 5, 2018, 4:27pm UTC](https://discuss.elastic.co/t/deleting-indices-older-than-90-days/122811/20 "2018-04-05T16:27:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.