# When filebeat logs are deleted, does this delete Elasticsearch indices?

**URL:** <https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408>\
**Category:** Elasticsearch\
**Created:** [February 15, 2024, 8:12pm UTC](https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408 "2024-02-15T20:12:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\
**Post date:** [February 15, 2024, 8:12pm UTC](https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408/1 "2024-02-15T20:12:12Z")

</div>

I have an elasticsearch cluster which ingests logs from Filebeat. I'm trying to limit the total size of the indices. If I delete the raw files that filebeat is ingesting, will the corresponding Elasticsearch indices be deleted as well? At the moment I'm manually using `curl -XDELETE`, which is not sustainable. If the strategy I describe won't work, how can I automatically delete indices for files older than a certain age?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 15, 2024, 8:18pm UTC](https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408/2 "2024-02-15T20:18:06Z")

</div>

You should use [ILM](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html)

---

<div class="post-metadata">

**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\
**Post date:** [February 15, 2024, 9:05pm UTC](https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408/3 "2024-02-15T21:05:03Z")

</div>

Aha - this is great, thank you. How about the question regarding deletion of the files which are being indexed?

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 15, 2024, 9:38pm UTC](https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408/4 "2024-02-15T21:38:46Z")

</div>

Deleting files off a device running Filebeat will not delete anything out of elasticsearch

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 16, 2024, 3:05am UTC](https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408/5 "2024-02-16T03:05:11Z")

</div>

Ah you mean delete processed files, then FB doesn't have that option like LS.  
Check [this](https://discuss.elastic.co/t/deleting-log-files-after-they-have-finished-processing/246382).

---

<div class="post-metadata">

**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\
**Post date:** [February 16, 2024, 2:21pm UTC](https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408/6 "2024-02-16T14:21:52Z")

</div>

Great, thanks to you both for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2024, 2:22pm UTC](https://discuss.elastic.co/t/when-filebeat-logs-are-deleted-does-this-delete-elasticsearch-indices/353408/7 "2024-03-15T14:22:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
