Automating deletion of the indexes in Elasticsearch with only Queries

Here is a tutorial on how to delete an indexes after 7 days. Everything will configured using queries, as an example let’s take indexes that starts with prod-.

Create a lifecycle policy that defines the appropriate phases and actions. You can use the following command to create a lifecycle policy:

PUT _ilm/policy/delete-prod-after-7days
{
  "policy": {
    "phases": {
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

This policy has only one phase, which is the delete phase. The min_age parameter specifies the minimum age of the index before it can be deleted. In this case, it is set to 7d, which means that the index will be deleted after 7 days. The actions parameter specifies the action to be taken when the index meets the criteria specified in the phase. In this case, it is set to delete, which means that the index will be deleted.

Create an index template to apply the policy to each new index. You can use the following command to create an index template:

PUT _index_template/delete-prod-data-after-7days
{
  "template": {
    "settings": {
      "index": {
        "lifecycle": {
          "name": "delete-prod-after-7days",
          "rollover_alias": "prod"
        }
      }
    }
  },
  "index_patterns": [
    "prod*"
  ]
}

This index template specifies that the lifecycle policy delete-prod-after-7days should be applied to all indices that match the pattern prod*. The rollover_alias parameter specifies the alias that should be used for rollover operations.

Create an initial index. You can use the following command to create an initial index:

PUT /prod-000001

This command creates an index with the name prod-000001.

Verify that the policy is applied to the index. You can use the following command to check the status of the index:

GET /prod-000001/_ilm/explain

This command will provide you with detailed information about the index’s lifecycle policy. If the policy is not applied to the index, you can apply it by running the following command:

PUT /prod-000001/_settings
{
  "index": {
    "lifecycle": {
      "name": "delete-prod-after-7days"
    }
  }
}

Wait for 7 days. After 7 days, the index will be deleted automatically.

I hope this helps. Let me know if you have any other questions.