Retiring old Elasticsearch indices

Elastic Stack Elasticsearch
1

Hi all

I'm curious about retiring old indices. As far as I know, by default Elasticsearch stores data forever. Question number one: is there any option to set in config files some period (four weeks, for example) after which data would get automatically deleted?

I also know indices can be deleted by using curl -xdelete, for example: curl -XDELETE localhost:9200/logstash-2016.11.*. This is something I could cron. Question two: is deleting data in such way safe? What I mean is whether using it would not break other indices / some other stuff?

Many thanks for your help

2

You can manage all of this with cron and Curator.

Deleting indices via the API is safe.

3

So, as I assume, there is no built-in ELK option to enable that sets data (indices) retention limit?

4

That's right, that's what Curator is built for.

5

That is correct. You can read more about Curator at https://www.elastic.co/guide/en/elasticsearch/client/curator/current/index.html

6

Right. I will look into that. Thanks, guys!