ElasticSearch Index Rollover with Timestamps
If you are using ElasticSearch for storing system or application logs, then your ES cluster can quickly gets very big. Fortunately, ElasticSearch provides functionality for automatic rollover and deletion of indices. Here is how to configure it. Note: all configurations and examples here are based on ELK 7.x. Some functionalities are not available in previous versions. If you are using an older version, consider upgrading. Create lifecycle polices ElasticSearch provides the Index Lifecycle Policies (ilp) functionality, which can rollover indices. It is configured, by defining the phases of an index (hot, warm, cold, delete). When handling logs, we can store them in different indices, which are rolled over automatically on certain conditions (size or time). Additionally old logs indices can be deleted to free up space. In the example below we are creating a lifecycle policy " test ". The "hot" phase, in which the index is ...