ILM Delete Only Phase

Hi there,

I'm running ELK 7.6. I create daily indexes with names like every 24hrs.

I need to delete indices greater than 30 days. Besides using curator, can I use the following settings in ILM instead?


I'm pretty sure you can, just specify the policy in the template. I think I did something like this when ILM was new.

One warning, if you are setting @timestamp from the log contents, say in winlogbeat, and old events are ingested, new indices will be created for each day in those old events. So if I get May 1 data today, a index-2020-05-01 index will be created and live for 30 days.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.