Something like below should work i have not tested it. you will need to replace indexname with the name of your index check logstash config files. You will also need to make sure the 127.0.0.1 ip address is the one you would like to use. I currently have it set to 1d which is 1day but change that to what ever you like. to learn how to edit mapping see here
curl -XPUT http://127.0.0.1:9200/_mapping {"indexname" : {"_ttl" : { "enabled" : true, "default" : "1d" }}}
EDIT:
I have not tested this it may work it may blow up the server at your own risk.
P.S: play around with elasticsearch its becoming my favorite database over the last few months.