We are thinking about storing the events generated from our system for the last 2 weeks into elasticsearch. How exactly shoud be configured elesticsearch to get such a functionality, to "automatically" create a new index each day, and to remove indices older than 2 weeks? Would be even possible to archive the old indices for 2 more weeks and remove them after 30 days? Or should be better that the application sending the events to elasticsearch handles programmatically such a functionality?
I am using docker-compose to launch the elastic search nodes and kibana.
Check out the new index life-cycle management (ILM) feature: https://www.elastic.co/blog/implementing-hot-warm-cold-in-elasticsearch-with-index-lifecycle-management
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.