How to delete the data in index on timestamp basis

Elastic Stack Elasticsearch
1

Hi,

I am having index in the following format

logstash-system.info and the index contains last 5 years of data. I want to purge only last 1 year of data in that index. Is it possible to delete it using any other tool.

I have come across many information in blogs that it can be resolved using curator but they suggesting the index format should be in the followign format logstash-system.info-[YYYY.MM.dd] to achieve. I c an't do this because I am using latest version of kibana in that I am getting deprecated warning when I suppose to create index with time format.

Any guidnace will be helpful for me to proceed further.

Thanks

2

What version are you on?

3

I am using Kibana 4.4.1 and Elasticsearch 2.2.1

4

The use of timeseries index naming in the Kibana configuration is deprecated but the use of timeseries indexes itself isn't. Recent versions of ES/Kibana are clever enough not to scan all of the data even if you're just looking for data from the last 24 hours (for example) while older versions need extra help.

5

Without creating with time series then how can I delete some data from the index like last one year or last 10 days data(without deleting the index).

6

You need to use this - https://www.elastic.co/guide/en/elasticsearch/plugins/current/plugins-delete-by-query.html