ILM Delete Only Phase

[ckough (CK)]

Hi there,

I'm running ELK 7.6. I create daily indexes with names like logstash-yyyy.mm.dd every 24hrs.

I need to delete indices greater than 30 days. Besides using curator, can I use the following settings in ILM instead?

Thanks,
ck

[rugenl (Len Rugen)]

I'm pretty sure you can, just specify the policy in the template. I think I did something like this when ILM was new.

One warning, if you are setting @timestamp from the log contents, say in winlogbeat, and old events are ingested, new indices will be created for each day in those old events. So if I get May 1 data today, a index-2020-05-01 index will be created and live for 30 days.