We are using Elasticsearch mostly for Observability. We have almost 1000 + VM' where we have deployed fleet agent to capture metrics.
We would like to delete data if > 90 days. Please be noted we are using standard storage so everthing we keep is Hot and no concept of cold or warm. For 90 days we would like to keep in Hot and delete after that
So, trying to create a Index Life Cycle policy but need your help. Appreciate any help here.
setup ILM (in Kibana click delete button it enables you an option to set delete age) or you can do all via API.
create index template
assign ILM onto index template
bootstrap index with alias
start ingest into alias
rollover means - it creates new index every for instance day (configurable rollover size/age)
you keep writing data to alias so ILM ensure it points to correct latest index
when index ages to 90days it is deleted.
this is the same principle like with database partitions.