使用 kibana 或 Elasticsearch 本身将保留天数设置为 Elasticsearch 索引

Question

I have some indices that I have to apply retention policies to.

Indice-a - date_of_creation 30 days
Indice-b - date_of_creation 180 days

Is there a way to set retention policies to those Indices on Kibana? If not, how can I set them on elasticsearch?

Answer 1

Since ELK 6.6 (XPack) there is index lifecycle management.

In the ELK 7.16 you can use Index Lifecycle Policies in kibana

Stack Management > Index Lifecycle Policies. Click Create policy.

---

In older versions as your indexes contain timestamp you can write script to generate list of indexes to delete and then run loop over such list and call curl -XDELETE