Need guide for data retension/archiving

Elastic Stack Elasticsearch
1

Hello all,
I'm using ES 1.7.4 with Graylog. this system stores almost 200GB of data per month.
After several months of test and live-use, I realize that I don't need more than 2 or 3 months of data on ES. so I decided to delete old data.
but who knows? there's always unexpected situation.

After some searches, I found that I can simply 'close' indices. and It seems more safe than delete, but It uses disk spaces... :frowning:

Is there any guide for data retension or archiving?

Thanks for any help.

2

I would recommend using the snapshot and restore functionality in Elasticsearch to backup older indices to some form of shared storage. This frees up space on the node and allows you to restore the data back if necessary.

3

Thanks for response. I'll try it :slight_smile:

4

So snapshot/restore isn't really a great archiving solution because Elasticsearch can only restore snapshots from the last major version. We don't have a better archiving solution built in though.