Logstash data rotation

Elastic Stack Logstash
1

Hi,

I am running ELK 5.4.3 to capture syslog and SNMP traps. To manage space on disk I want to delete older data.

Can someone pls give me hints for:

  1. deleting data older than 90 days
  2. moving data older than 90 days to some other remote host (scp, ftp)
  3. restore old data, when needed, from remote host to ELK machine

Regards,
-Manish

2

The answer to 1 is Elasticsearch Curator.

2 and 3 can also be performed using the snapshot and restore API, which is also available through Curator.

3

Thanks It works :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.