I'm using ES 1.7.4 with Graylog. this system stores almost 200GB of data per month.
After several months of test and live-use, I realize that I don't need more than 2 or 3 months of data on ES. so I decided to delete old data.
but who knows? there's always unexpected situation.
After some searches, I found that I can simply 'close' indices. and It seems more safe than delete, but It uses disk spaces...
Is there any guide for data retension or archiving?
Thanks for any help.