Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I can't figure out how to apply this documentation http://www.elasticsearch.org/guide/reference/mapping/ttl-field/ to logstash. Specifically, i don't know which keys to use (instead of "tweet" etc).

The goal is to have all logs sent to elasticsearch via log stash expire after X days.

share|improve this question
    
if your placing the ttl on the index level then put the index name insteed of tweet. if the ttl is on the type level then put the name of the type. –  WojonsTech Aug 5 '13 at 10:03
    
@WojonsTech thanks for the tip, however i have never worked with Elasticsearch before and have now clue on how to do what you suggested :( –  Maciej Swic Aug 5 '13 at 10:17

1 Answer 1

Something like below should work i have not tested it. you will need to replace indexname with the name of your index check logstash config files. You will also need to make sure the 127.0.0.1 ip address is the one you would like to use. I currently have it set to 1d which is 1day but change that to what ever you like. to learn how to edit mapping see here

curl -XPUT http://127.0.0.1:9200/_mapping {"indexname" : {"_ttl" : { "enabled" : true, "default" : "1d" }}}

EDIT: I have not tested this it may work it may blow up the server at your own risk.

P.S: play around with elasticsearch its becoming my favorite database over the last few months.

share|improve this answer
    
Is there any way to set a default ttl for all indexes? I know it may not be very common but this server is used exclusively for logs and a new index is created every month so setting it for every month is cumbersome. –  Maciej Swic Aug 5 '13 at 10:26
    
@MaciejSwic i put a change i am not sure if it will work or not it should but this at your own risk. –  WojonsTech Aug 5 '13 at 10:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.