Search code examples
elasticsearchelastic-stackelk

How to rotate ELK logs?

I have indexes around 250 GB all-together in 3 host i.e. 750 GB data in ELK cluster.

So how can I rotate ELK logs to keep three months data in my ELK cluster and older logs should be pushed some other place.

Solution

  • Answer by dexter_ is correct, but as the answer is old, a better answer would be:

    version 7.x of elastic stack provides a index life cycle management policies, which can be easily managed with kibana GUI and is native to elk stack. PS, you still have to manage the indices like "indexname-%{+YYYY.MM}" as suggested dexter_

    elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html