4

I can't figure out how to apply this documentation http://www.elasticsearch.org/guide/reference/mapping/ttl-field/ to logstash. Specifically, i don't know which keys to use (instead of "tweet" etc).

The goal is to have all logs sent to elasticsearch via log stash expire after X days.

Maciej Swic
  • 270
  • 5
  • 18
  • if your placing the ttl on the index level then put the index name insteed of tweet. if the ttl is on the type level then put the name of the type. – WojonsTech Aug 05 '13 at 10:03
  • @WojonsTech thanks for the tip, however i have never worked with Elasticsearch before and have now clue on how to do what you suggested :( – Maciej Swic Aug 05 '13 at 10:17

1 Answers1

3

Something like below should work i have not tested it. you will need to replace indexname with the name of your index check logstash config files. You will also need to make sure the 127.0.0.1 ip address is the one you would like to use. I currently have it set to 1d which is 1day but change that to what ever you like. to learn how to edit mapping see here

curl -XPUT http://127.0.0.1:9200/_mapping {"indexname" : {"_ttl" : { "enabled" : true, "default" : "1d" }}}

EDIT: I have not tested this it may work it may blow up the server at your own risk.

P.S: play around with elasticsearch its becoming my favorite database over the last few months.

WojonsTech
  • 350
  • 1
  • 10
  • Is there any way to set a default ttl for all indexes? I know it may not be very common but this server is used exclusively for logs and a new index is created every month so setting it for every month is cumbersome. – Maciej Swic Aug 05 '13 at 10:26
  • @MaciejSwic i put a change i am not sure if it will work or not it should but this at your own risk. – WojonsTech Aug 05 '13 at 10:35