Home / server / Questions / 528180
In Process
Maciej Swic
Asked: 2013-08-02 23:11:50 +0800 CST

Adding TTL to elasticsearch with logstash

  • 772

I can't figure out how to apply this documentation http://www.elasticsearch.org/guide/reference/mapping/ttl-field/ to logstash. Specifically, i don't know which keys to use (instead of "tweet" etc).

The goal is to have all logs sent to elasticsearch via log stash expire after X days.

linux

1 Answers

  1. Something like below should work i have not tested it. you will need to replace indexname with the name of your index check logstash config files. You will also need to make sure the 127.0.0.1 ip address is the one you would like to use. I currently have it set to 1d which is 1day but change that to what ever you like. to learn how to edit mapping see here

    curl -XPUT http://127.0.0.1:9200/_mapping {"indexname" : {"_ttl" : { "enabled" : true, "default" : "1d" }}}

    EDIT: I have not tested this it may work it may blow up the server at your own risk.

    P.S: play around with elasticsearch its becoming my favorite database over the last few months.

    • 3