TTL gone in 5.0 -OMG

TTL is not coming back in the foreseeable future. Probably not ever.

While your user experience may have been acceptable, it was not so for every user. The effect on the underlying Lucene structures is not ideal, as it drastically affects tiered merging of segments (under the hood — you never see it as a user unless you know how to look for it), to say nothing of the increased I/O load required to perform it. Additionally, some users were using it in lieu of better practices (like using time-series indices) which their use cases should have been using.

Another reason TTL was removed is that its default behavior was to scan all of the documents in the specified index every 60 seconds to see if the TTL expired. For larger indices, the overhead of this became astronomical. It really was a suboptimal solution for the desired outcome, even if you feel it worked well for your use case.

There are still other reasons, which you can read about in GitHub and perhaps in some of the release notes/blogs.

As you mentioned, the workaround to not having TTL (but wanting it) is to use the delete_by_query plugin instead. Yes, it requires scheduling on your part.

You'd probably do just as well—if not better—by using aliases to associate a series of time-series indices (making them behave as one index for querying purposes), and drop indices after they exceed your desired retention period. As far as keeping things tied down to single indices per 'job', have you investigated using the rollover API? It could feature in to a scheme like this very nicely.

3 Likes