# Keep data in a rolling window of 3 months

**URL:** https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [January 18, 2023, 9:38pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458 "2023-01-18T21:38:13Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Harsh0145](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh0145/32/116118_2.png) [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)
#### Post date: [January 18, 2023, 9:38pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/1 "2023-01-18T21:38:13Z")

</div>

Hi,  
I am trying to delete or archive documents older than 3 months. Since our use case allows customers to update the data for the last 3 months, so at any moment in time, we should have the last 3 months of data. According to my understanding, the ILM policy will delete the entire index after a set period (or when shard grows to a set size, etc). Suppose new data is indexed in the past 299 days, then the rollover day, the whole index will be deleted and we will not be able to update the previous data. Is there a way to handle this situation using ILM or any query?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 18, 2023, 9:56pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/2 "2023-01-18T21:56:10Z")

</div>

Welcome to our community! 😃

What sort of data is this?

---

<div class="post-metadata">

### Author: ![Harsh0145](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh0145/32/116118_2.png) [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)
#### Post date: [January 18, 2023, 10:57pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/3 "2023-01-18T22:57:33Z")

</div>

We can make updates to data in any rolling window of 3 months so it shouldn't come under time series data. Mostly contains client's data. Also it's used for transactional queries.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 18, 2023, 11:09pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/4 "2023-01-18T23:09:17Z")

</div>

ILM works on the assumption that the data is immutable once it is indexed, so the removal of data is handled at the index level. If you are updating data then you can't use ILM.

That's why I asked what sort of data it is.

You will have to manage this outside of ILM. A delete by query can do it, but it's expensive.

---

<div class="post-metadata">

### Author: ![Harsh0145](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh0145/32/116118_2.png) [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)
#### Post date: [January 19, 2023, 12:35am UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/5 "2023-01-19T00:35:41Z")

</div>

Got it. Thank you

---

<div class="post-metadata">

### Author: ![Harsh0145](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh0145/32/116118_2.png) [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)
#### Post date: [January 24, 2023, 2:27pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/6 "2023-01-24T14:27:40Z")

</div>

Hi is there any alternative to QueryBuilder(ES 5.6) in ES 8.6 ?

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [January 24, 2023, 3:11pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/7 "2023-01-24T15:11:29Z")

</div>

Hey.

That's another question. Could you please open a new discussion for this and share more details about what you are meaning?

---

<div class="post-metadata">

### Author: ![Harsh0145](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh0145/32/116118_2.png) [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)
#### Post date: [January 24, 2023, 3:31pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/8 "2023-01-24T15:31:31Z")

</div>

Sure.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2023, 3:31pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458/9 "2023-02-21T15:31:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
