Hello I am new to ELK and found the ILM feature.
I have a few questions:
I have a index : performancebyuser that I load data to every day. I created a ILM policy which I thought would take the files and delete the files that were older than 60 days.
But when I added the policy to the index it deleted everything.
I think that I am miss understanding the documentation.
Can someone please explain what I am doing wrong.
What I would like to happen is for the performancebyuser index if the data is older than 60 days then delete just those files/data. This way we always only have 60 days of data.
thanks
ILM and Curator assumes time-based indices and therefore delete complete indices that are deemed to contain only expired data. Deleting select data from an index is not supported.
So then what would be the best way to handle this use case? The problem that we are having is that we are using the cloud cluster and keep running into having to up the memory. We would like to stop having to do this.
One way would be to create a periodic delete-by-query job externally that deletes the appropriate data.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.