# Deleting old indices? **URL:** \ **Category:** Elasticsearch\ **Created:** [March 20, 2015, 5:09am UTC](https://discuss.elastic.co/t/deleting-old-indices/22773 "2015-03-20T05:09:36Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Siddharth\_Trikha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth_trikha/32/133867_2.png) [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Post date:** [March 20, 2015, 5:09am UTC](https://discuss.elastic.co/t/deleting-old-indices/22773/1 "2015-03-20T05:09:36Z")
I am using the ELK stack for analyzing logs. So as per default configuration a new index by "logsatash-YYYY-MM-DD" is created by ES. So if I have configured logstash to read like this: /var/log/rsyslog/\*\*/2014-12-0[1-7]/auditd.log So it is reading old logs and the index name created will be "logstash-2015-03-20", so this index will have documents (logs) of previous dates. My problem occurs when I have to delete indexes. If I have to keep only last one weeks data and purge the older indices. When I will delete index names except the last 7 days, _I have no track which days logs are kept in which index name_. Eg: 2014-12-07 date's logs may be kept in any of index named logstash-2015-03-19 or logstash-2015-03-20. So how shall I delete indexes?? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/66554121-9bb9-45df-82a3-7e70c455dd93%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/66554121-9bb9-45df-82a3-7e70c455dd93%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 20, 2015, 6:02am UTC](https://discuss.elastic.co/t/deleting-old-indices/22773/2 "2015-03-20T06:02:51Z")
You should really be setting the event timestamp to the one from the log file. If you ask over on [Redirecting to Google Groups](https://groups.google.com/forum/?hl=en-GB#!forum/logstash-users) you will get some guidance on that. On 19 March 2015 at 22:09, Siddharth Trikha [siddharthtrikha9@gmail.com](mailto:siddharthtrikha9@gmail.com) wrote: > I am using the ELK stack for analyzing logs. So as per default > configuration a new index by "logsatash-YYYY-MM-DD" is created by ES. > So if I have configured logstash to read like this: > > /var/log/rsyslog/\*\*/2014-12-0[1-7]/auditd.log > > So it is reading old logs and the index name created will be > "logstash-2015-03-20", so this index will have documents (logs) of previous > dates. > > My problem occurs when I have to delete indexes. If I have to keep only > last one weeks data and purge the older indices. When I will delete index > names except the last 7 days, _I have no track which days logs are kept > in which index name_. Eg: 2014-12-07 date's logs may be kept in any of > index named logstash-2015-03-19 or logstash-2015-03-20. > > So how shall I delete indexes?? > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/66554121-9bb9-45df-82a3-7e70c455dd93%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/66554121-9bb9-45df-82a3-7e70c455dd93%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/66554121-9bb9-45df-82a3-7e70c455dd93%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/66554121-9bb9-45df-82a3-7e70c455dd93%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X8gD7MGff-R%3DNjdSJsHHcKJyTwVxZ1gmdx%3DLqT2J8cMXg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X8gD7MGff-R%3DNjdSJsHHcKJyTwVxZ1gmdx%3DLqT2J8cMXg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:25am UTC](https://discuss.elastic.co/t/deleting-old-indices/22773/3 "2017-07-06T00:25:25Z")