Setting up a retention policy for ElasticSearch

We may want to delete old logs.

Navigate to index management.

This is a sample policy to delete logs older than 30 days.

{
  "policy": {
    "policy_id": "delete_old_indexes",
    "description": "Delete old indexes",
    "default_state": "warm",
    "states": [
      {
        "name": "warm",
        "actions": [],
        "transitions": [
          {
            "state_name": "delete",
            "conditions": {
              "min_index_age": "30d"
            }
          }
        ]
      },
      {
        "name": "delete",
        "actions": [
          {
            "delete": {}
          }
        ],
        "transitions": []
      }
    ],
    "ism_template": [
      {
        "index_patterns": [
          "cardinal-logs-*"
        ]
      }
    ]
  }
}