I have an elasticsearch cluster which ingests logs from Filebeat. I'm trying to limit the total size of the indices. If I delete the raw files that filebeat is ingesting, will the corresponding Elasticsearch indices be deleted as well? At the moment I'm manually using curl -XDELETE, which is not sustainable. If the strategy I describe won't work, how can I automatically delete indices for files older than a certain age?
You should use ILM
Aha - this is great, thank you. How about the question regarding deletion of the files which are being indexed?
Deleting files off a device running Filebeat will not delete anything out of elasticsearch
1 Like
Ah you mean delete processed files, then FB doesn't have that option like LS.
Check this.
Great, thanks to you both for your help!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.