# Logstash data rotation

**URL:** <https://discuss.elastic.co/t/logstash-data-rotation/94433>\
**Category:** Logstash\
**Created:** [July 25, 2017, 7:32am UTC](https://discuss.elastic.co/t/logstash-data-rotation/94433 "2017-07-25T07:32:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mkain](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@mkain](https://discuss.elastic.co/u/mkain)\
**Post date:** [July 25, 2017, 7:32am UTC](https://discuss.elastic.co/t/logstash-data-rotation/94433/1 "2017-07-25T07:32:10Z")

</div>

Hi,

```
I am running ELK 5.4.3 to capture syslog and SNMP traps. To manage space on disk I want to delete older data.

```

Can someone pls give me hints for:

1. deleting data older than 90 days
2. moving data older than 90 days to some other remote host (scp, ftp)
3. restore old data, when needed, from remote host to ELK machine

Regards,  
-Manish

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [July 25, 2017, 4:53pm UTC](https://discuss.elastic.co/t/logstash-data-rotation/94433/2 "2017-07-25T16:53:08Z")

</div>

The answer to 1 is [Elasticsearch Curator](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/index.html).

2 and 3 can also be performed using the snapshot and restore API, which is also available through Curator.

---

<div class="post-metadata">

**Author:** ![mkain](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@mkain](https://discuss.elastic.co/u/mkain)\
**Post date:** [August 2, 2017, 7:49am UTC](https://discuss.elastic.co/t/logstash-data-rotation/94433/3 "2017-08-02T07:49:59Z")

</div>

Thanks It works 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2017, 7:50am UTC](https://discuss.elastic.co/t/logstash-data-rotation/94433/4 "2017-08-30T07:50:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.