Log Retention in SO 2.4

[loganterfehr]

If I wanted to delete out old logs after 90 days how would I go about doing that? I want to set a retention policy of 90 days of stored logs and then after that period delete the oldest out. I noticed that SO no longer uses Curator, so how would I go about this? Thanks. Any help is appreciated.

[cm-ops]

If you wanted to do all logs you could set the delete policy in Administration > configuration > elasticsearch >index_settings > index_name > policy > phases > delete You will need advanced toggled on and set it to 90d.

[loganterfehr]

Do you mean elasticsearch > index_settings > index_template > phases > delete > min_age set to 90?

I do not have index_name or policy

[cm-ops]

You would need to select the index name, for example so-zeek

[loganterfehr]

And do this for each index if I wanted to have all logs retained for a max of 90 days?

[loganterfehr]

Or would the 'global_overrides' section do it for all? It seems like it would.