Shipping logs to s3 after end of index lifecycle

Elastic Stack Elasticsearch
1

Hi! My team has a managed elastic instance and we are currently shipping our logs to it. The created indices go through the log life cycle process (hot, warm, cold) as specified in the docs.

My issue is that instead of deleting them after the end of this life cycle, I would like to ship them to an AWS s3 instance for indefinite storage. Would this be possible to do from the Elastic/Kibana platform? When in the life cycle of the indices is not important to me (they can be sent out as soon as they get to elastic) but I would like to use the platform for this purpose. Any suggestions?

2

That's not something that ILM does at this stage. It might be worth creating a GitHub issue as a feature request so we can gauge support for it.

3

Thank you for the quick answer! Would you know if there are other kibana or filebeat tools that would allow me to do this? I will create a Github issue unless there's any workaround for this. Willing to look at any alternatives within the stack.

4

You might be able to do something with Logstash, but it's nothing out-of-the-box.

5

Got it, thank you!