How to delete the docs which are older than 5 hours from an index using curator and the index must remain

Elastic Stack Elasticsearch
1

i want remaining docs should be stay rather than old docs in a index

2

Curator deletes complete indices, not documents within an index so it may not be suitable here. What is the use case? Why delete documents that are only 5 hours old?

3

my usecase is to delete indices older than 44 hours
so i create hourly indexes in logstash but it cause shards failed because of multiple indices so i want solution to create index in every 5 hours so the number of indexes is minimum.

I want alternative from you for this use case

4

I would recommend looking into the rollover api.

5

but i have 100 of indices than how to do that manaully for each

6

You can use rollover with Curator or ILM. If that is not an option due to the number of indices I suspect you will need to create some kind of custom automated process or simply reduce the number of indices until it is more manageable.

1 Like
7

@Christian_Dahlqvist
how to do that please help

8

I do not know your use case, data or indexing strategy so I am afraid that is something you will need to come up with yourself.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.