When filebeat logs are deleted, does this delete Elasticsearch indices?

Elastic Stack Elasticsearch
1

I have an elasticsearch cluster which ingests logs from Filebeat. I'm trying to limit the total size of the indices. If I delete the raw files that filebeat is ingesting, will the corresponding Elasticsearch indices be deleted as well? At the moment I'm manually using curl -XDELETE, which is not sustainable. If the strategy I describe won't work, how can I automatically delete indices for files older than a certain age?

2

You should use ILM

3

Aha - this is great, thank you. How about the question regarding deletion of the files which are being indexed?

4

Deleting files off a device running Filebeat will not delete anything out of elasticsearch

1 Like
5

Ah you mean delete processed files, then FB doesn't have that option like LS.
Check this.

6

Great, thanks to you both for your help!

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.