Remove or delete old data from elastic search

Question

How to remove old data from elastic search index as the index has large amount of data being inserted every day.

Answer 1

You can do that with delete by query plugin.

Assuming you have some timestamp or creation date field in your index, your query would look something like this

DELETE /your_index/your_type/_query
{
  "query": {
    "range": {
      "timestamp": {
        "lte": "now-10y"
      }
    }
  }
}

This will delete records older than 10 years.

I hope this helps

Answer 2

Split data to daily indexes and use alias as old index name. then Delete the each index daily. just as logstash:

Daily indices :logstash-20151011,logstash-20151012,logstash-20151013.

Full Alias: logstash

Then daily delete last index.