I was looking at a solution to delete old logs and I was suggested to set up ILM.
I only now realize that ILM rolls over the entire index rather than old entries. If I understand correctly if I set up ILM to 3 months and then move to deletion, after 3 months it would delete the entire index.
Is there a way to set it so after 3 months, only entires that are older than 3 months will be deleted? Is it possible to do so for storange as well (once reaches 250GB delete old entires)?