Search code examples
pythonelasticsearchkibanaretentionelasticsearch-indices

Set retention days to a Elasticsearch indices, using kibana or Elasticsearch itself

I have some indices that I have to apply retention policies to.

Indice-a-date_of_creation 30 days
Indice-b-date_of_creation 180 days

Is there a way to set retention policies to those Indices on Kibana? If not, how can I set them on elasticsearch?

Solution

  • Since ELK 6.6 (XPack) there is index lifecycle management.

    In the ELK 7.16 you can use Index Lifecycle Policies in kibana

    Stack Management > Index Lifecycle Policies. Click Create policy.

    In older versions as your indexes contain timestamp you can write script to generate list of indexes to delete and then run loop over such list and call curl -XDELETE