Need guide for data retension/archiving

(Eugene Gwon) #1

Hello all,
I'm using ES 1.7.4 with Graylog. this system stores almost 200GB of data per month.
After several months of test and live-use, I realize that I don't need more than 2 or 3 months of data on ES. so I decided to delete old data.
but who knows? there's always unexpected situation.

After some searches, I found that I can simply 'close' indices. and It seems more safe than delete, but It uses disk spaces... :frowning:

Is there any guide for data retension or archiving?

Thanks for any help.

(Christian Dahlqvist) #2

I would recommend using the snapshot and restore functionality in Elasticsearch to backup older indices to some form of shared storage. This frees up space on the node and allows you to restore the data back if necessary.

(Eugene Gwon) #3

Thanks for response. I'll try it :slight_smile:

(Nik Everett) #4

So snapshot/restore isn't really a great archiving solution because Elasticsearch can only restore snapshots from the last major version. We don't have a better archiving solution built in though.

(system) #5