ILM to delete only doc counts in a simple indice elasticsearch

Hi there !

I'm working on a lifecycle for my indices in elasticsearch.

To put you in context, I recover the logs of 20 applications with the ELK stack but I notice that my storage disk is filling up very quickly.

Therefore, I would like to create a lifecycle policy to delete the docs from an index older than 30 days (but keep the index all the same).

Is that possible ?

Thanks in advance

No, that is not possible using ILM. ILM works by deleting complete indices and can not selectively delete data from within an index.

You probably need to periodically delete data using a delete-by-query job, possibly runvia a shell script triggered through cron. There is no built-in support for this in Elasticsearch or Kibana.

Ok got it !

Thank you for your answer

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.