TTL not deleting documents


(Harsha Vardhan) #1

Hi,

I am using logstash to push logs to elasticsearch. My mapping which was created automatically using template is

{
"default": {
"_ttl": {
"enabled": true,
"default": 1296000000
},
"properties": {}
},
"keystone": {
"_ttl": {
"enabled": true,
"default": 1296000000
},
"properties": {
"message": {
"type": "string"
},
"@timestamp": {
"format": "dateOptionalTime",
"type": "date"
},
"level": {
"type": "string"
},
"host": {
"type": "string"
},
"path": {
"type": "string"
},
"type": {
"type": "string"
},
"@version": {
"type": "string"
}
}
}
}

Its been more than 20 days but still documents are not deleted yet. Can anyone please help?


(David Pilato) #2

Not sure what is happening but don't do that! It's super inefficient.

You'd better index in daily indices then remove indices older than 20 days. That's immediate.

Note that curator helps a lot doing that.


(Harsha Vardhan) #3

Sure David, I will write a cron job to delete old indices.

Thanks for the help


(system) #4