0

I use elasticsearch for logs, I don't want to use daily index to delete them with a cron job but with the TTL. I 've actived and set TTL with the value: 30s. I have a succesfull answer when I send this operation and I can see the TTL value(in milliseconds) when I do the mapping request. All seems good but documents are not be deleted...

_mapping :

{
    "logs" : {
        "webservers" : {
            "_ttl" : {
                "default" : 30000
            },
            "properties" : {
                @timestamp" : {         
                    "type" : "date",
                    "format" : "dateOptionalTime" 
                }
            }
        }
    }
}
javanna
  • 59,145
  • 14
  • 144
  • 125
Matt
  • 4,309
  • 7
  • 38
  • 52
  • What does the get mapping returns after you indexed some data? Is the `_ttl` together with the other fields you indexed? By the way, are you using logstash? – javanna Apr 02 '13 at 13:29
  • mapping command return {"_ttl" : {"default" : 30000}... with the other fields. Yes, I'm using logstach by I don't wan't to have a new index each day. – Matt Apr 02 '13 at 13:57

1 Answers1

1

I guess you just need to enable _ttl for your type, which is disabled by default. Have a look here.

{
    "webservers" : {
        "_ttl" : { "enabled" : true, "default" : "30s" }
    }
}
javanna
  • 59,145
  • 14
  • 144
  • 125
  • I just tested it and it worked for me. One thing I noticed: the get mapping api gives me back enabled:true as well. Are you sure that part of the json was currently digested by elasticsearch? Maybe there was a typo? One more thing: you're indexing with logstash in your own index, how do you do that exactly? – javanna Apr 02 '13 at 18:24
  • You're right I've a problem to enable this feature because when I set "enabled" to true or false, get mapping returns always the same result: only the TTL value. To create my index, I've just replaced the index name "logstash-%..." by "logs". For information, I use Kibana to see my logs and he works well(He requires the logstash format) – Matt Apr 03 '13 at 16:25
  • Thanks for the info! Let me know if there's anything else I can do for you ;) – javanna Apr 03 '13 at 17:02
  • 1
    hummm very strange. To be sure that my modification in logstash has not an impact on the working of the TTL feature of ES, I've remove her and use the default configuration of logstash for the index creation. And I've always the same issue. I set the TTL, the query returns "true" but it doesn't works. And the get mapping give me only the value for the TTL but not his status(enabled:True/false). – Matt Apr 04 '13 at 09:34
  • I have the same problem. My query `put http://localhost:9200/test/record/_mapping` with data `{"record":{"_ttl":{"enabled":true,"default":"60s"}}}` returns only TTL value. So it doesn't work. – solo117 Apr 25 '13 at 12:18
  • Which version of elasticsearch are you guys using? – javanna Apr 30 '13 at 19:04