Is curator delete log files or only delete indices?

[PiCarODD (Hein Htet Aung)]

Hi,

I need some help with curator.
Curator delete indices well but my storage increase and increase.

Thanks

[rugenl (Len Rugen)]

Check the size of the /var/log/elasticsearch directory. If you use logstash, also check /var/log/logstash. Curator won't manage those directories and Elastic doesn't ship anything like logrotate configurations.

[PiCarODD (Hein Htet Aung)]

What is impact if we delete elasticsearch database logs?
Thanks

[rugenl (Len Rugen)]

/var/log/elasticsearch logs are not database logs in the sense of mysql recovery logs, they are just messages of events in the past. I delete them after 7 days using a cron job, but I also ingest these using the filebeat elasticsearch module. I keep those for 30 days.

Here's my delete job, for example:

#!/bin/bash

stack="{{ES_cluster}}"

find /var/log/elasticsearch/ -type f -name "${stack}_audit-2*.log" -mtime +7 -exec rm {} \;
find /var/log/elasticsearch/ -type f -name "${stack}*.log.gz" -mtime +7 -exec rm {} \;

(This is an Ansible template, so there is substitution done when deployed. This method of invoking rm can be dangerous, test well!)