I have a problem, for some reason the previous Elasticsearch Admin configured an Index in a way that this index does not create a daily rollout. I will explain this better:
I have a filebeat index running and every single day it create an index like this:
filebeat-7.4.0-2019-10-29
filebeat-7.4.0-2019-10-28
filebeat-7.4.0-2019-10-27
filebeat-7.4.0-2019-10-26
.
.
.
but the index that I am talking about, does not create this kind of break down I only have an thisisanIndex, right now, because of this I'm in a big problem since this index is using 1.3Tb of space and I cannot delete old indeces.
Do you know if there is a way I can configure this index to make that rollover every day? or how can I delete somo of the docs on this index to free some space in my cluster.
Hi @eemtzc,
I would recommend you to look into index lifecycle management, which can do the roll over automatically.
Thank you for your response, just to be sure, ILM will be able to break that huge index of 1.2 Tb into smaller indices by day so I can delete the old ones?
It will help for any future indices, but not for the existing huge one. For that, you should look at reindexing through a pipeline that uses the Date Index Name Processor.
Alternatively, you could Reindex into an ILM alias
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.