TTL not deleting documents

Elastic Stack Elasticsearch
1

Hi,

I am using logstash to push logs to elasticsearch. My mapping which was created automatically using template is

{
"default": {
"_ttl": {
"enabled": true,
"default": 1296000000
},
"properties": {}
},
"keystone": {
"_ttl": {
"enabled": true,
"default": 1296000000
},
"properties": {
"message": {
"type": "string"
},
"@timestamp": {
"format": "dateOptionalTime",
"type": "date"
},
"level": {
"type": "string"
},
"host": {
"type": "string"
},
"path": {
"type": "string"
},
"type": {
"type": "string"
},
"@version": {
"type": "string"
}
}
}
}

Its been more than 20 days but still documents are not deleted yet. Can anyone please help?

2

Not sure what is happening but don't do that! It's super inefficient.

You'd better index in daily indices then remove indices older than 20 days. That's immediate.

Note that curator helps a lot doing that.

3

Sure David, I will write a cron job to delete old indices.

Thanks for the help