I am trying to setup elastic search cluster for production. I have approximately 500 vms which we will be monitoring. I am expecting 2gig data every day. I will be installing Metric beats and files beats on servers.
I want to save 2 years worth of data and backup rest to a mount and delete on the servers.
I am planning of using 2 vms with 4 cpu and 400gb of diskspace. One will be master and the other will be node.
Is there a configuration in Elastic search where I can mention that only 2 years worth of data to remain on the vm and backup remaining to a mount and delete on the server.