How to delete the indices older than 30 days

[nikhilesh]

Hi Team,

i am using ELK version 7.5, i would like to delete the indices which are older than 30 days.

can i create the index life cycle policy to achieve this?

Also, does this policy deletes the default indices which will be created starting name with dot (.)(.kibana_task_manager_1 (like this)) when installed the ELK setup.

Thanks
NIkhilesh Gade

[Bamieh (Ahmad Bamieh)]

Hello,

Yes ILM (index lifecycle management) will help you achieve this. In kibana there is a UI to help you create such policies under Management > Index Lifecycle Policies

You can apply policies to kibana's .* indices although it is not recommended as these are managed by kibana itself.

To delete indices after 30 days, simply enable the "Delete phase" and set it to 30 days

[nikhilesh]

Thanks Bamieh for the quick response .

After creating the policy, the requirement is it should not delete the indices that are managed by kibana itself. means by default there are some of the indices which are created automatically with the setup (ex..below) with starting with dot(.)

.triggered_watches
.apm-custom-link
.tasks
.watches
.security-7
.async-search
.apm-agent-configuration
.kibana-event-log-7.8.0-000001
.ml-config
.kibana_1

Thanks
Nikhilesh Gade

[nikhilesh]

Does this ILM policy include system indices as well for deletion?

Thanks
Nikhilesh Gade

[nikhilesh]

Any help on this please?

[Bamieh (Ahmad Bamieh)]

I'm not sure I fully understood your last question.

Does this ILM policy include system indices as well for deletion?

You can attach the policy to any index pattern, even the ones starting with a dot.

After creating the policy, click on add policy to index template:

Then you can specify any index template you're after. The policy can include deletion rules as well.

You can learn the full details about ILM by following the docs: Getting started with index lifecycle management | Elasticsearch Guide [7.5] | Elastic

[nikhilesh]

Thanks Bamieh for your help. i will check that.

[nikhilesh]

Hi Bameih,

I have attached the index template and updated a policy to delete the index older than 25 days. but still i can see the index exists.

at what time the policy executes?if i created the policy now , will it applicable to delete the indexes older than 25 days.?

Thanks
Nikhilesh Gade

[elasticforme (Sachin)]

Nikhilesh
you have to create a policy (ILM) and then link your index to this ILM policy
and it will act only on that indexes.

for example my index name is mysystem_logs-2020-01, mysystem_logs-2020-02 .....
and my ILM is link to that index. then it will only delete that index. nothing else

[nikhilesh]

yeah, i did same. but could see indexes still exists.

I did not enabled roll over, i gave the delete phase(PFB).

Here i could see my indices still exists, after applied the policy.

[elasticforme (Sachin)]

when you go to ILM tab on you should see something like this

This tells me I have 13 index which has this policy assign.

now if you go to your index management select and you will be able to assign this ILM policy to that index

[nikhilesh]

Thanks sachin:) for your help