Filebeat how to delete indexes automaticality after a few days

Hello I have installed ELK and I would like to optimise it a little bit.

CentOS Linux release 7.9.2009 (Core)
bin/kibana --version
bin/elasticsearch --version
Version: 8.6.2, Build:

I'm using filebeat and after a few days indexes are too much and my system is crashing because of lack of space. I'm deleting the indexes manually now, but would like to do it automatically. Is there a way how can I achieve this?

Have a look at using ILM policies to manage your data retention.

Thank you,

but maybe I missed something.

Here is what I see when I tried to add policy to the index.

"Policy filebeat_delete is configured for rollover, but index filebeat-8.6.2-2023.09.05 does not have an alias, which is required for rollover."

I created lifecycle policy named "filebeat_delete" and set some details as max size and delete after X days, but It seems it doesnt work.

Can you try to enable ILM in filebeat.yml (Configure index lifecycle management | Filebeat Reference [8.9] | Elastic). Filebeat will create ILM while setup.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.