Elasticsearch does not delete anything by itself. To have different retention policies for different kind of logs, use multiple index series (e.g. logstash-shortterm-YYYY.MM.DD and logstash-longterm-YYYY.MM.DD) and use Curator to cull one of the series after e.g. 30 days.