configure TTL in elastic search with index templat

Question

I have requirement to only store data for 10 days in elastic search which is coming through logstash. As I don't have too much data so I am taking approach for setting up TTL through index template.

Could anybody let me know what is exactly I have to do.

I can go for creation of index template and in template file I have kept the following code in default.json file

{
   "_ttl" : {
    "enabled" : true,
    "default" : "10d"
 }  
}

But I am not sure where to keep this file and how that file is getting called. will it get called automatically or will I have to call manually.

Could anybody Please let me know the step by step configuration.

Answer 1

The _ttl field has been deprecated in ES 2 and completely removed in ES 5.

What you should do instead is to use one index per timeframe (day, week, month) that makes sense for your use case.

In Logstash, simply use the following pattern for naming your index "logstash-%{+YYYY.MM.dd}" in your elasticsearch output.

Once you have that set up you can use the curator tool to delete indices older than 10 days, it's pretty straightforward.