[ElasticSearch v.7.5] How to delete all indexes older than 6 month automatically?

Elastic Stack Elasticsearch
1

How to delete all indexes older than 6 month automatically?

2

I would:

3

Take into account that it is currently not possible to perform the upgrade, what are the steps for deleting all indexes older than six months automatically?

4

In addition , the provided link is very large and have many chapters that I don't know where to find what I need and what action plan should I do in order to achieve my simple request of delete all indexes older than 6 month.

5

What are your index names?

6

myindex_2023_04
myindex1_2023_05_14
myindex3-2023-06

sample

7

Once you have identified the list of indices, you can run:

DELETE index1,index2,index3

Or you can try to generate the index name using date maths. See Date math support in index and index alias names | Elasticsearch Guide [7.17] | Elastic

8

โ€the question was how to delete indexes older than 6 months.
โ€we have a large amount of indexes with different names and each index have monthly or daily fashion

9

That's what I wrote with date math. You can use that with some wildcards I guess.

But ideally use ILM. That will make your life easier.

Otherwise a shell script and iterate over the list of indices. You might have the creation date as a metadata.

10

โ€What is the detailed action plant to configure ILM to do the that?

11

You should read the documentation.

With recent versions of Kibana, you would be most likely guided to configure all that from the Kibana admin interface. Not sure about your old version though. Give it a look.

But basically, you'd need to define a Delete Policy.

Probably as well, apply manually the policy to your index: Manage existing indices | Elasticsearch Guide [7.17] | Elastic

You have an API example in that page: Configure a lifecycle policy | Elasticsearch Guide [7.17] | Elastic

Basically something like:

PUT _ilm/policy/my_policy
{
  "policy": {
    "phases": {
      "delete": {
        "min_age": "180d",
        "actions": {
          "delete": {} 
        }
      }
    }
  }
}

PUT index-names*/_settings 
{
  "index": {
    "lifecycle": {
      "name": "my_policy"
    }
  }
}

And if ILM is not started yet:

POST _ilm/start

Alternatively, you could have a look at Curator Reference [8.0] | Elastic

12

Thank you very much.
โ€Is it possible to use the last version of kibana with Elasticsearch 7.5?

13

No it's not.

14

  1. โ€How to set a delete policy as a default for any index that will be created in the future?

  2. How set a delete policy for all existing indices?

15

What did you try so far? What can you see on Kibana? What is unclear?

16

I will rewrite better my previous questions

  1. โ€Is it posible to set a delete policy as a default for any index that will be created in the future?
  2. Is it possible to set a delete policy for all existing indices?
17

Yes, you can do this through an index template. Look at the links David provided above for details.

Yes can do this by updating the settings of all or a selection of indices. Look at the example David provided.

1 Like
18

โ€updating the settings can be done in one command for a group of indices or you have to do it for each index?

19

The example David provided updates the setting based on a index pattern with wildcard, so it is as you can see possible to update in groups.

1 Like
20

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.