Unable to delete data older than 7 days from elastic search

[pratsy (Pratyush Agarwal)]

Unable to delete data older than 7 days from elasticsearch using following command

curl -XDELETE 'http://localhost:9200/*' -d '
{
  "query": {
    "range": {
      "@timestamp": { 
        "lt": "now-7d"
      }
    }
  }
}' -H "Content-Type:application/json"

Don't want to use curator (so much problem with versions).

Above command is deleting data older than current date.

Please suggest a proper query for the same.

[Christian_Dahlqvist]

Are you looking to delete complete indices or only some data from a set of indices? What are the problems with Curator versions you are referring to?

[pratsy (Pratyush Agarwal)]

@Christian_Dahlqvist Basically want to keep the retention of 7 days data. So, want to delete all data older than 7 days in elastic search.

I was using curator 5.5.1 and using the command :
curator --host localhost --port 9200 delete indices --older-than 7 --time-unit days --timestring %Y.%m.%d

but getting error of not able to find --host

Hence looking for a query

[theuntergeek (Aaron Mildenstein)]

@pratsy

curator --host localhost --port 9200 delete indices --older-than 7 --time-unit days --timestring %Y.%m.%d

This is outdated syntax which will not work with Curator 5.5.1. You must be following directions from a very old blog post. Please check the official documentation for usage of the current version.

[pratsy (Pratyush Agarwal)]

@theuntergeek can you help me with getting the query for curator ? not able to figure out the things I need to do other than action file.

Query for : Deleting data from elastic which is older than 7 days

Thanks

[pratsy (Pratyush Agarwal)]

Solved !

Found awesome documentation for the same.

http://www.madhur.co.in/blog/2017/04/09/usingcuratordeleteelasticindex.html

Thanks