# Set active index

**URL:** <https://discuss.elastic.co/t/set-active-index/19098>\
**Category:** Elasticsearch\
**Created:** [August 5, 2014, 3:04pm UTC](https://discuss.elastic.co/t/set-active-index/19098 "2014-08-05T15:04:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rhys\_Campbell](https://avatars.discourse-cdn.com/v4/letter/r/d78d45/32.png) [@Rhys\_Campbell](https://discuss.elastic.co/u/Rhys_Campbell)\
**Post date:** [August 5, 2014, 3:04pm UTC](https://discuss.elastic.co/t/set-active-index/19098/1 "2014-08-05T15:04:35Z")

</div>

Hi All,

I have setup a EFK system just for testing at the moment.

It's running in a VM with not much RAM and I am having problem with the  
elasticsearch process because of this. The VIRT = 12GB which is  
approximately the total size of the indexes.

My indexes are split by date like so...

logstash-2014.06.01  
logstash-2014.06.02...

and so on. I'm guessing elasticsearch is trying to hold all of this in RAM.  
Is there a way I can setup elasticsearch to only search a specific index  
(or number of indices)? Is it just a case of archiving the logs I don't  
want ES to deal with? Ideally I'd like to work with only the last day or  
two of indexes which will hopefully all fit into RAM.

Cheers,

Rhys

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4b2533dd-752b-442f-9ba3-a71de0cac6ff%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4b2533dd-752b-442f-9ba3-a71de0cac6ff%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\
**Post date:** [August 5, 2014, 3:17pm UTC](https://discuss.elastic.co/t/set-active-index/19098/2 "2014-08-05T15:17:51Z")

</div>

You can set up an alias for the indexes you want to query and use only the  
alias for queries, not the direct index names:

> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.

For archiving, look into the curator script, which helps close/delete old  
indexes:

> **[GitHub - elastic/curator: Curator: Tending your Elasticsearch indices](https://github.com/elastic/curator)**
>
> Curator: Tending your Elasticsearch indices. Contribute to elastic/curator development by creating an account on GitHub.

Sematext/Otis did tweet about something related that could be interesting,  
but did not elaborate further:

> <https://twitter.com/sematext/status/496322872672260097>

Cheers,

Ivan

On Tue, Aug 5, 2014 at 8:04 AM, Rhys Campbell \<[rhys.james.campbell@gmail.com](mailto:rhys.james.campbell@gmail.com)

> wrote:

> Hi All,
> 
> I have setup a EFK system just for testing at the moment.
> 
> It's running in a VM with not much RAM and I am having problem with the  
> elasticsearch process because of this. The VIRT = 12GB which is  
> approximately the total size of the indexes.
> 
> My indexes are split by date like so...
> 
> logstash-2014.06.01  
> logstash-2014.06.02...
> 
> and so on. I'm guessing elasticsearch is trying to hold all of this in  
> RAM. Is there a way I can setup elasticsearch to only search a specific  
> index (or number of indices)? Is it just a case of archiving the logs I  
> don't want ES to deal with? Ideally I'd like to work with only the last day  
> or two of indexes which will hopefully all fit into RAM.
> 
> Cheers,
> 
> Rhys
> 
> --  
> You received this message because you are subscribed to the Google Groups  
> "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an  
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> To view this discussion on the web visit  
> [https://groups.google.com/d/msgid/elasticsearch/4b2533dd-752b-442f-9ba3-a71de0cac6ff%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4b2533dd-752b-442f-9ba3-a71de0cac6ff%40googlegroups.com)  
> [https://groups.google.com/d/msgid/elasticsearch/4b2533dd-752b-442f-9ba3-a71de0cac6ff%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/4b2533dd-752b-442f-9ba3-a71de0cac6ff%40googlegroups.com?utm_medium=email&utm_source=footer)  
> .  
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCeB90u78%3D\_8kr2PGJ7u6SvVhN6G4Tcoek%2B6h\_8uGijtQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCeB90u78%3D_8kr2PGJ7u6SvVhN6G4Tcoek%2B6h_8uGijtQ%40mail.gmail.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:10am UTC](https://discuss.elastic.co/t/set-active-index/19098/3 "2017-07-06T01:10:42Z")

</div>


