How to delete index document after 30 days?

[Kishor_Patidar]

I'm working with AWS OpenSearch and tried to implement an Index State Management (ISM) policy to delete documents that are older than 30 days. However, the policy ended up deleting the entire index, not just the aged documents. I also attempted to use _delete_by_query, which worked as expected, but I'm looking for a different approach.

Is there an alternative way to automatically delete documents once they've reached 30 days old? Also, is there a way to set a time-to-live (TTL) on individual documents to control their lifespan?

[system]

OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance. See What is OpenSearch and the OpenSearch Dashboard? | Elastic for more details.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns )

[Christian_Dahlqvist]

@Kishor_Patidar

Is there an alternative way to automatically delete documents once they've reached 30 days old? Also, is there a way to set a time-to-live (TTL) on individual documents to control their lifespan?

As far as I know the answer is no. You do indeed need to use delete by query. This is as the bot pointed out not the correct forum, so you need to ask the OpenSearch community as they may have something I am not aware of.

[dadoonet (David Pilato)]

Did you look at Cloud by Elastic, also available if needed from AWS Marketplace, Azure Marketplace and Google Cloud Marketplace?

Cloud by elastic is one way to have access to all features, all managed by us. Think about what is there yet like Vector Search, Security, Monitoring, Reporting, ES|QL, Canvas, Maps UI, Alerting and built-in solutions named Observability, Security and what is coming next ...