Retiring old Elasticsearch indices

Hi all

I'm curious about retiring old indices. As far as I know, by default Elasticsearch stores data forever. Question number one: is there any option to set in config files some period (four weeks, for example) after which data would get automatically deleted?

I also know indices can be deleted by using curl -xdelete, for example: curl -XDELETE localhost:9200/logstash-2016.11.*. This is something I could cron. Question two: is deleting data in such way safe? What I mean is whether using it would not break other indices / some other stuff?

Many thanks for your help

You can manage all of this with cron and Curator.

Deleting indices via the API is safe.

So, as I assume, there is no built-in ELK option to enable that sets data (indices) retention limit?

That's right, that's what Curator is built for.

That is correct. You can read more about Curator at

Right. I will look into that. Thanks, guys!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.