Elasticsearch does not delete anything by itself. To have different retention policies for different kind of logs, use multiple index series (e.g. logstash-shortterm-YYYY.MM.DD and logstash-longterm-YYYY.MM.DD) and use Curator to cull one of the series after e.g. 30 days.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.