# Making logs expire relative to the timestamp and not the indexing time(system time)

**URL:** <https://discuss.elastic.co/t/making-logs-expire-relative-to-the-timestamp-and-not-the-indexing-time-system-time/11988>\
**Category:** Elasticsearch\
**Created:** [May 16, 2013, 5:35am UTC](https://discuss.elastic.co/t/making-logs-expire-relative-to-the-timestamp-and-not-the-indexing-time-system-time/11988 "2013-05-16T05:35:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sushil\_Singh](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@Sushil\_Singh](https://discuss.elastic.co/u/Sushil_Singh)\
**Post date:** [May 16, 2013, 5:35am UTC](https://discuss.elastic.co/t/making-logs-expire-relative-to-the-timestamp-and-not-the-indexing-time-system-time/11988/1 "2013-05-16T05:35:59Z")

</div>

I am using Elastic Search with a TTL for each index, and I have 1 index per  
day.

Now the problem is: I get my logs to expire , say 1 day(which I specify in  
the _default_.json) after the indexing, but what I want is the logs should  
expire relative to the timestamp of the logs(which I parse and replace the  
timestamp with) and not the time when the logs were indexed.

How do I do this?  
Need expert help please.

Thanks

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:36am UTC](https://discuss.elastic.co/t/making-logs-expire-relative-to-the-timestamp-and-not-the-indexing-time-system-time/11988/2 "2017-07-06T02:36:25Z")

</div>


