ILM to delete only doc counts in a simple indice elasticsearch

Elastic Stack Elasticsearch
1

Hi there !

I'm working on a lifecycle for my indices in elasticsearch.

To put you in context, I recover the logs of 20 applications with the ELK stack but I notice that my storage disk is filling up very quickly.

Therefore, I would like to create a lifecycle policy to delete the docs from an index older than 30 days (but keep the index all the same).

Is that possible ?

Thanks in advance

2

No, that is not possible using ILM. ILM works by deleting complete indices and can not selectively delete data from within an index.

You probably need to periodically delete data using a delete-by-query job, possibly runvia a shell script triggered through cron. There is no built-in support for this in Elasticsearch or Kibana.

3

Ok got it !

Thank you for your answer

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.