使用索引模板在弹性搜索中配置TTL [英] configure TTL in elastic search with index template

问题描述

我有要求仅通过logstash存储弹性搜索中的10天数据。因为我没有太多的数据，所以我正在采用通过索引模板设置TTL的方法。

I have requirement to only store data for 10 days in elastic search which is coming through logstash. As I don't have too much data so I am taking approach for setting up TTL through index template.

任何人都可以让我知道我要做的是什么。

Could anybody let me know what is exactly I have to do.

我可以在创建索引模板和模板文件中保存以下代码在默认 .json文件

I can go for creation of index template and in template file I have kept the following code in default.json file

{
   "_ttl" : {
    "enabled" : true,
    "default" : "10d"
 }  
}

但我不知道在哪里保存此文件该文件如何被调用。
将自动调用，或者我必须手动调用。

But I am not sure where to keep this file and how that file is getting called. will it get called automatically or will I have to call manually.

任何人请让我一步一步的配置。

Could anybody Please let me know the step by step configuration.

推荐答案

_ttl 字段已经在ES 2中弃用，并在ES 5中完全删除。

The _ttl field has been deprecated in ES 2 and completely removed in ES 5.

您应该做的是在每个时间框架（日，周，月）上使用一个索引，这对您的用例是有意义的。

What you should do instead is to use one index per timeframe (day, week, month) that makes sense for your use case.

在Logstash中，只需使用以下模式命名索引logstash - ％{+ YYYY.MM.dd}弹性搜索输出。

In Logstash, simply use the following pattern for naming your index "logstash-%{+YYYY.MM.dd}" in your elasticsearch output.

一旦你设置好了，你可以使用策展人工具<一个href =https://www.elastic.co/guide/en/elasticsearch/client/curator/current/ex_delete_indices.html =nofollow noreferrer>删除超过10天的索引，很漂亮直截了当。

Once you have that set up you can use the curator tool to delete indices older than 10 days, it's pretty straightforward.

这篇关于使用索引模板在弹性搜索中配置TTL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！