How to delete the indices older than 90 days

Elastic Stack Elasticsearch
1

Hi,

We are using Elasticsearch mostly for Observability. We have almost 1000 + VM' where we have deployed fleet agent to capture metrics.

We would like to delete data if > 90 days. Please be noted we are using standard storage so everthing we keep is Hot and no concept of cold or warm. For 90 days we would like to keep in Hot and delete after that

So, trying to create a Index Life Cycle policy but need your help. Appreciate any help here.

Thanks,
Pravyn

2

Index lifecycle (ILM) is the right place to configure this policy
you do not need to use warm, cold stage in order to delete indices using ILM
follow the procedure : Tutorial: Automate rollover with ILM | Elasticsearch Guide [8.3] | Elastic

  1. setup ILM (in Kibana click delete button it enables you an option to set delete age) or you can do all via API.
  2. create index template
  3. assign ILM onto index template
  4. bootstrap index with alias
  5. start ingest into alias

thats it

for clarification:
rollover means - it creates new index every for instance day (configurable rollover size/age)
you keep writing data to alias so ILM ensure it points to correct latest index
when index ages to 90days it is deleted.
this is the same principle like with database partitions.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.