Rollup, removing the rolled-up data safely?

Elastic Stack Elasticsearch
1

I can't find a way to be sure a document or an index has been rolled-up before removing it.

When using the Rollup API to gain space and get smaller indexes / longer data retention, there is obviously a removing process to engage. But as I understand this is not part of the Rollup features.

So if I configured a Job to Rollup logs older than a month, I should be able to remove raw logs older than a month via DELETE INDEX or Delete By Query. BUT what if the Rollup did not run yet? How can I be sure I'm not deleting documents I did not merge yet?!!

Thank you! :slight_smile:

2

I've written a blog post about this issue - maybe not everyone want to delete the raw data after rolling up, but instead put them to sleep (closing index i.e.). Stills bother me ^^

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.