How to configure the retention policy for an index to delete data that is one hour old?

[SrinivasaC]

Hi,

We have an index, and for every half an hour, it's indexing with 350,000 of events. After every ONE Hour, the previous ONE hour of data is no longer required. So, how can I delete that 1 hour old data from the index, or how can we handle this situation to free up my index memory/ index events after every one hour.

• What would be the minimum retention period for the Index in Hot/Warm/Cold buckets?
• What would be the minimum Frozen-period for the index?

Thanks in advance.

[Yasaswy]

Hi,
you can try frozenTimePeriodInSecs, rotatePeriodInSecs options.

Eg:
frozenTimePeriodInSecs=3600
rotatePeriodInSecs=30

Also dpeneding on the data size you are receiving you can try other options

maxTotalDataSizeMB
homePath.maxDataSizeMB
coldPath.maxDataSizeMB

check out the spec for options..