# Elastic Search/Kibana Alias basics/roll over/delete after 90 days

**URL:** <https://discuss.elastic.co/t/elastic-search-kibana-alias-basics-roll-over-delete-after-90-days/240032>\
**Category:** Elasticsearch\
**Created:** [July 6, 2020, 3:47pm UTC](https://discuss.elastic.co/t/elastic-search-kibana-alias-basics-roll-over-delete-after-90-days/240032 "2020-07-06T15:47:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\
**Post date:** [July 6, 2020, 3:47pm UTC](https://discuss.elastic.co/t/elastic-search-kibana-alias-basics-roll-over-delete-after-90-days/240032/1 "2020-07-06T15:47:39Z")

</div>

i've been using ES for about 2 yrs, never need to really store anything long term, so alias's and rollovers were never needed. I understand the concept, but cant seem to find any good resources in a walk-through or best practices.

what i'm trying to do is basically only keep 90 days worth of my firewall logs and 30 days worth of metricbeat logs.

Any resources or pointers would be appreciated.  
Thank you  
Darrell

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 6, 2020, 10:37pm UTC](https://discuss.elastic.co/t/elastic-search-kibana-alias-basics-roll-over-delete-after-90-days/240032/2 "2020-07-06T22:37:52Z")

</div>

Do you mean [ILM](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-start.html)?

---

<div class="post-metadata">

**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\
**Post date:** [July 7, 2020, 12:57pm UTC](https://discuss.elastic.co/t/elastic-search-kibana-alias-basics-roll-over-delete-after-90-days/240032/3 "2020-07-07T12:57:41Z")

</div>

yes, i guess it all goes together. you need an alias to get ILM working?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 7, 2020, 9:59pm UTC](https://discuss.elastic.co/t/elastic-search-kibana-alias-basics-roll-over-delete-after-90-days/240032/4 "2020-07-07T21:59:29Z")

</div>

That is part of it, yes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2020, 9:59pm UTC](https://discuss.elastic.co/t/elastic-search-kibana-alias-basics-roll-over-delete-after-90-days/240032/5 "2020-08-04T21:59:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.