I am trying to figure out how to limit the number of logs on Elastic/Kibana/Logstash to only hold 3 months worth of data. It is all installed on windows servers.
I'd look at
So, I create a new index lifecycle policy with Hot Phase set to index size 50GB, Max age 90 days, then enable the Delete phase and set that to 90 days from rollover? Then just apply that to the only policy that has a linked indices?
I believe so. That should work.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.