Deleting the 30 day olderdata from the elastic search

Elastic Stack Elasticsearch
1

Hello all,

Thanks in advance

I want to delete the logs which are older 3 days from my elastic search index

I have read about curator and have few doubts pertaining to it. I was wondering what exactly rollover option does in curator and what configuration changes needs to be done in elasticsearch.yml to make this option work.

Do I have to create a new index with this option or can I use the existing indices to accommodate my need

2

It simply executes the Rollover API.

Nothing needs to be changed in elasticsearch.yml. It's only a series of normal API calls. Please refer to the Rollover API documentation to see how to create your initial index & alias.

3

if i have created an initial index using the logstash.conf will that impact the proceeding

I do have a index already created using the logstash.conf which i want use it, is that possible

4

That will depend on the index name, and whether you can point an alias at it.

5

I have my indices created per day basis my intent is to store 30 days of logs at any give point of time

example:06/12/2018-07/11/2018

on 07/12 i want to delete 06/12

can i use curator to achieve this

6

Yes. But if you're doing daily indices, you don't need Rollover. You can just use the regular age filter to catch indices older than a set number of days.

7

Hey @theuntergeek

If I don't want to use the curator is there way to delete time based indices
i have indices created per day and want to delete indices which are older than 30 days
Will there be any performance impact

8

Sure. Write your own script that makes the API calls you want.

There would be a performance impact for keeping indices for a longer period of time, but generally not an impact for deleting them.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.