Is there a way to delete indices related to syslog messages with a specific severity?
For example if I would like to keel debug logs during 7 days but all others during 31 days? Is-it possible ?
Could we do the same with tags? For example logs with tag "application1' => keep logs during 7 days and logs with tag "application2" => keep logs during 31 days?