Auto Deletion of Old index

Security
1

Hi community,
I am exploring the index lifecycle policy and auto deletion of an index. I have gone through the following link.

I have understood that we can create index template with policy where we can setup parameters like max_size , min_age for deletion for an index. And all the index with given index-pattern of the template obey that policy.

For our specific use case, We have defined index-pattern like (logs-test-*) in the template and our index are like (logs-test-2021.12.10, logs-test-2021.12.11, … , logs-test-2021.12.15). Is there any way to create policy or any setting in index template such that only the older index like (logs-test-2021.12.10) is deleted when total size of all index (logs-test-2021.12.10, logs-test-2021.12.11 … logs-test-2021.12.15) greater than some threshold lets say 20 GB.

Thanks,
Triptesh

2

Hi @triptesh1212. Just to be clear. Your expectation is to delete the oldest index when the total size of all indices with specific pattern is bigger than i.e. 20 GB?

3

Hi @pablo , yes, we are trying to get that.

4

@triptesh1212 Thanks for confirming. This is an index lifecycle management question and is not related to the security plugin.

In regards to your issue, I don’t think it would be possible from the Index Management level. Index lifecycle phases (hot, warm, cold) are initiated based on the individual index metrics i.e. age, size and not the size of other indices.