Unable to delete data older than 7 days from elastic search


(Pratyush Agarwal) #1

Unable to delete data older than 7 days from elasticsearch using following command

curl -XDELETE 'http://localhost:9200/*' -d '
{
  "query": {
    "range": {
      "@timestamp": { 
        "lt": "now-7d"
      }
    }
  }
}' -H "Content-Type:application/json"

Don't want to use curator (so much problem with versions).

Above command is deleting data older than current date.

Please suggest a proper query for the same.


(Christian Dahlqvist) #2

Are you looking to delete complete indices or only some data from a set of indices? What are the problems with Curator versions you are referring to?


(Pratyush Agarwal) #3

@Christian_Dahlqvist Basically want to keep the retention of 7 days data. So, want to delete all data older than 7 days in elastic search.

I was using curator 5.5.1 and using the command :
curator --host localhost --port 9200 delete indices --older-than 7 --time-unit days --timestring %Y.%m.%d

but getting error of not able to find --host

Hence looking for a query


(Aaron Mildenstein) #4

This is outdated syntax which will not work with Curator 5.5.1. You must be following directions from a very old blog post. Please check the official documentation for usage of the current version.


(Pratyush Agarwal) #5

@theuntergeek can you help me with getting the query for curator ? not able to figure out the things I need to do other than action file.

Query for : Deleting data from elastic which is older than 7 days

Thanks


(Pratyush Agarwal) #6

Solved !

Found awesome documentation for the same.

http://www.madhur.co.in/blog/2017/04/09/usingcuratordeleteelasticindex.html

Thanks


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.