❗️ These instructions apply only to Kibana/Elasticsearch versions 7.4 or higher. Earlier versions of Elasticsearch and Kibana did not provide all of the UI features mentioned in this guide. Instead, for version 6.8 or earlier, refer to our aptible/elasticsearch-logstash-s3-backup application.If you’re using Elasticsearch to hold log data, you’ll almost certainly be creating new indexes periodically - by default, Logstash or Aptible log drains will do so daily. New indexes will necessarily mean that as time passes, you’ll need more and more disk space, but also, less obviously, more and more RAM. Elasticsearch allocates RAM on a per-index basis, and letting your log retention grow unchecked will almost certainly lead to fatal issues when the database runs out of RAM or disk space.
logstash-*
. You can leave all other settings as default. This template will ensure all new daily indexes get the lifecycle policy applied.
logstash-*
index, click Manage, and then Apply Lifecycle Policy. Choose the policy you created earlier. If you want to apply the policy in bulk, you’ll need to use the update settings API directly.