Elasticsearch Shard Retention

Elastic Stack Elasticsearch
1

Situation; I'm currently shipping windows logs to elasticsearch via winlogbeat and grabbing specific events from the past 3 months. All I really want is the last 3 months of logs and nothing else. Each day has its own index, with 5 shards per index and 450 shards for 90 days. So what is the best way in going about automated shard deletion?

Question;

  1. Can I setup shards so they have 90 day TTL?
  2. Shards have dates in their name, can I if date < 90 days = delete ?
  3. Where do I set this up?

Any information provided will be much appreciated.

Thanks!

2

This is exactly what Curator was designed to assist with.

3

Thanks man!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.