# Retention policy characteristics

**URL:** https://discuss.elastic.co/t/retention-policy-characteristics/343879
**Category:** Elasticsearch
**Created:** [September 26, 2023, 12:43pm UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879 "2023-09-26T12:43:36Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Tostis](https://avatars.discourse-cdn.com/v4/letter/t/c67d28/32.png) [@Tostis](https://discuss.elastic.co/u/Tostis)
#### Post date: [September 26, 2023, 12:43pm UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879/1 "2023-09-26T12:43:36Z")

</div>

Hello,  
I am pretty new to Elasticsearch, but got some questions about retention policies.

If I am implementing a retention policy for example to delete old data from a index if it is older then 5 days. How is this handled by Elasticsearch? If the task kicks in to run the retention policy, so deleting old data. Does this impact the performance? Could hardware usage on CPU, or RAM ramp up? I would guess that the retention policy is handled as a background task. So given a low priority and also not really intensive for hardware usage but I am not sure.  
How is it handled if at the same time new data comes in and old data is deleted? I would guess this is buffered in some kind of way.

Thanks a lot already!

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 26, 2023, 12:45pm UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879/2 "2023-09-26T12:45:44Z")

</div>

Elasticsearch ILM assumes the use of time-based indices and works by deleting complete indices once the data within them is older than the retention period. It does not support deleting select data from within an index.

---

<div class="post-metadata">

### Author: ![Tostis](https://avatars.discourse-cdn.com/v4/letter/t/c67d28/32.png) [@Tostis](https://discuss.elastic.co/u/Tostis)
#### Post date: [September 27, 2023, 8:21am UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879/3 "2023-09-27T08:21:12Z")

</div>

Thank you for replying.

So if I understand correctly if the retention policy starts deleting data, it is more of a group of data (indices) that is older then the retention period?  
But how is the delete task run. Does this delete task run and if necessary use all CPU and RAM of the system to handle the task? Or is it handled in the background and if something more important comes in, the delete task is parked for a moment?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 27, 2023, 8:26am UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879/4 "2023-09-27T08:26:20Z")

</div>

Deleting complete indices like ILM does is very light and does not consume a lot of resources at all. It does not delete data from an index but rather the full index.

---

<div class="post-metadata">

### Author: ![Tostis](https://avatars.discourse-cdn.com/v4/letter/t/c67d28/32.png) [@Tostis](https://discuss.elastic.co/u/Tostis)
#### Post date: [September 27, 2023, 8:53am UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879/5 "2023-09-27T08:53:14Z")

</div>

Does this change with the size of the index? I can imagine deleting a big index takes more resources in comparison to a small index.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 27, 2023, 8:55am UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879/6 "2023-09-27T08:55:51Z")

</div>

ILM drops the full index so it is very quick. It is no longer included in the cluster state and related files on disk are removed. Size does not really matter.

If you were deleting data from within the index, e.g. by delete by query, the size would matter and a lot more resources be used.

---

<div class="post-metadata">

### Author: ![Tostis](https://avatars.discourse-cdn.com/v4/letter/t/c67d28/32.png) [@Tostis](https://discuss.elastic.co/u/Tostis)
#### Post date: [September 28, 2023, 8:23am UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879/7 "2023-09-28T08:23:30Z")

</div>

Thanks for the answers!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 26, 2023, 8:23am UTC](https://discuss.elastic.co/t/retention-policy-characteristics/343879/8 "2023-10-26T08:23:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
