Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can't figure out how to apply this documentation to logstash. Specifically, i don't know which keys to use (instead of "tweet" etc).

The goal is to have all logs sent to elasticsearch via log stash expire after X days.

share|improve this question
if your placing the ttl on the index level then put the index name insteed of tweet. if the ttl is on the type level then put the name of the type. – WojonsTech Aug 5 '13 at 10:03
@WojonsTech thanks for the tip, however i have never worked with Elasticsearch before and have now clue on how to do what you suggested :( – Maciej Swic Aug 5 '13 at 10:17

Something like below should work i have not tested it. you will need to replace indexname with the name of your index check logstash config files. You will also need to make sure the ip address is the one you would like to use. I currently have it set to 1d which is 1day but change that to what ever you like. to learn how to edit mapping see here

curl -XPUT {"indexname" : {"_ttl" : { "enabled" : true, "default" : "1d" }}}

EDIT: I have not tested this it may work it may blow up the server at your own risk.

P.S: play around with elasticsearch its becoming my favorite database over the last few months.

share|improve this answer
Is there any way to set a default ttl for all indexes? I know it may not be very common but this server is used exclusively for logs and a new index is created every month so setting it for every month is cumbersome. – Maciej Swic Aug 5 '13 at 10:26
@MaciejSwic i put a change i am not sure if it will work or not it should but this at your own risk. – WojonsTech Aug 5 '13 at 10:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.