Can I manually trigger events in an index to roll to frozen?

[andrewtrobec]

Hello,

I am relatively new to the topic of event rolling between buckets, and I'd like to know how much flexibility I have in choosing what to roll and when. More specifically I would like to trigger an event to roll to frozen (i.e delete) based on field criteria within the event itself. Is this possible?

For example, if I am tracking tasks and I want closed tasks that are older than 6 months to be deleted (not soft delete using delete command), would it be possible to orchestrate some logic that will check both _time and state fields and then roll to frozen?

Thank you and best regards,

Andrew

[richgalloway · Accepted solution]

Events do not roll between buckets. Entire buckets roll from hot/warm to cold to frozen. Therefore, it is not possible to select individual events to freeze.