How to delete the data from ES index?
To delete indices/data, the best approach is to use the Delete API:
- More details and examples: Indices delete
- One should also run _cat/indices API first to see what all indices you have currently in the cluster and then delete accordingly: Cat Indices
A common use case for data is to keep it only for a defined time period and delete older documents, but that time period is up to ones business requirement. One might also want to delete data collected for specific indices. One can either delete data periodically with a tool like Curator
, or by using the Delete By Query API
or the Kibana Index Management UI
. We do not have any best practices on data retention in ES, we only suggest to keep the logs table around 1-2 million records at the most for SQL.