Policy to automatically delete indexes with max days and size

Elastic Stack Elasticsearch
1

Hello to all the Elastic Stack community and developers :slight_smile:

We have a server that use Elasticsearch to store logs, events and metrics. This server configure a policy which delete an Index if it is older that X days.

At the moment we have a situation where we define a property like that:

MAX_DAYS_DELETE=15

A new index is created each day, so indexes older than 15 days can be deleted.

Our server automatically set this policy to all indexes to make this work. This is an example of the policy applied:

{
  "cleanup_policy" : {
    "version" : 3,
    "modified_date" : "2020-11-13T16:47:13.011Z",
    "policy" : {
      "phases" : {
        "delete" : {
          "min_age" : "<MAX_DAYS_DELETE>d",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    }
  }
}

What is my goal

My goal is to have two parameters like this:

MAX_DAYS_DELETE=15
MAX_SIZE=100M

In this case, if an index is older than 15 days, it will be deleted. And if an index is exceeding such space, keep the same space (truncate old docs in this index).

My question

Is it possible to create a policy with those requirements? I can't find a good policy setup to make something like this.

2

AFAIK
You can not delete documents with a policy. You will have to delete the whole index.

3

Are you creating a policy per index that is created?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.