# Filebeat how to delete indexes automaticality after a few days

**URL:** <https://discuss.elastic.co/t/filebeat-how-to-delete-indexes-automaticality-after-a-few-days/342308>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 5, 2023, 6:52am UTC](https://discuss.elastic.co/t/filebeat-how-to-delete-indexes-automaticality-after-a-few-days/342308 "2023-09-05T06:52:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![R1d3rBG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/r1d3rbg/32/125307_2.png) [@R1d3rBG](https://discuss.elastic.co/u/R1d3rBG)\
**Post date:** [September 5, 2023, 6:52am UTC](https://discuss.elastic.co/t/filebeat-how-to-delete-indexes-automaticality-after-a-few-days/342308/1 "2023-09-05T06:52:19Z")

</div>

Hello I have installed ELK and I would like to optimise it a little bit.

CentOS Linux release 7.9.2009 (Core)  
bin/kibana --version  
8.6.2  
bin/elasticsearch --version  
Version: 8.6.2, Build:

I'm using filebeat and after a few days indexes are too much and my system is crashing because of lack of space. I'm deleting the indexes manually now, but would like to do it automatically. Is there a way how can I achieve this?

 ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc9f6c31d2ce192d420ff0041bbf2527eacf9239.png)

---

<div class="post-metadata">

**Author:** ![miltonhultgren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miltonhultgren/32/100401_2.png) [@miltonhultgren](https://discuss.elastic.co/u/miltonhultgren)\
**Post date:** [September 5, 2023, 7:21am UTC](https://discuss.elastic.co/t/filebeat-how-to-delete-indexes-automaticality-after-a-few-days/342308/2 "2023-09-05T07:21:44Z")

</div>

Hi!  
Have a look at using [ILM policies](https://www.elastic.co/guide/en/elasticsearch/reference/8.6/index-lifecycle-management.html#index-lifecycle-management) to manage your data retention.

---

<div class="post-metadata">

**Author:** ![R1d3rBG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/r1d3rbg/32/125307_2.png) [@R1d3rBG](https://discuss.elastic.co/u/R1d3rBG)\
**Post date:** [September 5, 2023, 5:33pm UTC](https://discuss.elastic.co/t/filebeat-how-to-delete-indexes-automaticality-after-a-few-days/342308/3 "2023-09-05T17:33:11Z")

</div>

Thank you,

but maybe I missed something.

Here is what I see when I tried to add policy to the index.

"Policy filebeat\_delete is configured for rollover, but index filebeat-8.6.2-2023.09.05 does not have an alias, which is required for rollover."

I created lifecycle policy named "filebeat\_delete" and set some details as max size and delete after X days, but It seems it doesnt work.

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [September 6, 2023, 7:47am UTC](https://discuss.elastic.co/t/filebeat-how-to-delete-indexes-automaticality-after-a-few-days/342308/4 "2023-09-06T07:47:51Z")

</div>

Can you try to enable ILM in `filebeat.yml` ([Configure index lifecycle management | Filebeat Reference [8.9] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html)). Filebeat will create ILM while setup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2023, 9:48am UTC](https://discuss.elastic.co/t/filebeat-how-to-delete-indexes-automaticality-after-a-few-days/342308/5 "2023-10-04T09:48:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.