How to prevent automatic deletion of indices

Elastic Stack Logstash
1

hi
After checking history of my logs in Discovery i found out that my logs just stored for 2 weeks and after that history of my logs is deleted. i didn't set up any policy in Index Lifecycle Policies. how can i fix this problem to keep my logs more then 2 weeks?

thanks

2

What version of the stack are you on?
What logs are you referring to?
Are you sure they don't have ILM policies applied to them, check using Get index lifecycle management status API | Elasticsearch Guide [7.14] | Elastic.

3

hi Warkolm
i think if found the reason of this issue. I found script in /opt/selks/delete-old-logs.sh i just modified the unit_count to 1 years:

#!/bin/bash

/usr/bin/curator_cli delete_indices --filter_list '
[
  {
    "filtertype": "age",
    "source": "creation_date",
    "direction": "older",
    "unit": "days",
    "unit_count":365
  },
  {
    "filtertype": "pattern",
    "kind": "prefix",
    "value": "logstash*"
  }
]
'

this script deleted all history of logstash-* indices and i and i executed GET /_ilm/status command my ilm status was running :

{
  "operation_mode" : "RUNNING"
}

should i stop it? i don't think it will fix my issue because just for your information i didn't configure any Alias for my indices then as you know you can assign any policy to your indices

4

Don't stop it, that wouldn't have been deleting your logs.

5

By the way thanks for your reply. :sunflower:

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.