Help with data management, I have an index with a size of 119GB, what can I do?

Elastic Stack Elasticsearch
1

I have an index with a size of 119GB that is causing performance issues when search the data.

My first thought was to use an index policy to expire old documents but soon I learned the lifecycle policy only works for the new documents of that index, is that right?

I used time series (@timestamp) and I would like to:

  1. Delete documents older than 3 months.
  2. Break/shrink into 40GB small chunks the data left in the index after expiring the old documents

I don't even know where to start. Help please!!!

2

ILM works on indices, not on documents. So if you are using time based events/documents, you should use time based indices and then ILM :slight_smile:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.