How to delete the docs which are older than 5 hours from an index using curator and the index must remain

i want remaining docs should be stay rather than old docs in a index

Curator deletes complete indices, not documents within an index so it may not be suitable here. What is the use case? Why delete documents that are only 5 hours old?

my usecase is to delete indices older than 44 hours
so i create hourly indexes in logstash but it cause shards failed because of multiple indices so i want solution to create index in every 5 hours so the number of indexes is minimum.

I want alternative from you for this use case

I would recommend looking into the rollover api.

but i have 100 of indices than how to do that manaully for each

You can use rollover with Curator or ILM. If that is not an option due to the number of indices I suspect you will need to create some kind of custom automated process or simply reduce the number of indices until it is more manageable.

1 Like

how to do that please help

I do not know your use case, data or indexing strategy so I am afraid that is something you will need to come up with yourself.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.