Life Cycle Policy with Filter rules?

Elastic Stack Elasticsearch
1

I can set size and age, to remove documents. But I want to skip someone if has special field, for example

Postpayment: true

never remove docs with field Postpayment, It`s possible?

2

Hi Change_Shell,

This isn't currently possible, but you could do it manually with a delete-by-query. ILM doesn't currently have that functionality though.

3

You mean call delete_by_query in scheduler?
with body something like that

"must_not": [
{
"term": {
"Postpayment" : true
}
}
]

4

You couldn't call it from the internal ILM scheduling, but you could do it from a Cron job. You may want to configure an additional part of the query to not delete data from the newer indices (that is dependent on your retention needs)