Filebeat how to delete indexes automaticality after a few days

[R1d3rBG (Lyudmil Zdravkov)]

Hello I have installed ELK and I would like to optimise it a little bit.

CentOS Linux release 7.9.2009 (Core)
bin/kibana --version
8.6.2
bin/elasticsearch --version
Version: 8.6.2, Build:

I'm using filebeat and after a few days indexes are too much and my system is crashing because of lack of space. I'm deleting the indexes manually now, but would like to do it automatically. Is there a way how can I achieve this?

[miltonhultgren]

Hi!
Have a look at using ILM policies to manage your data retention.

[R1d3rBG (Lyudmil Zdravkov)]

Thank you,

but maybe I missed something.

Here is what I see when I tried to add policy to the index.

"Policy filebeat_delete is configured for rollover, but index filebeat-8.6.2-2023.09.05 does not have an alias, which is required for rollover."

I created lifecycle policy named "filebeat_delete" and set some details as max size and delete after X days, but It seems it doesnt work.

[ashishtiwari1993 (Ashish Tiwari)]

Can you try to enable ILM in filebeat.yml (Configure index lifecycle management | Filebeat Reference [8.9] | Elastic). Filebeat will create ILM while setup.