Index Lifecycle

[oneCrazyAdmin]

Good Morning,

Zeek logs take up the most space in my Elasticsearch indexes. Currently I am trying to delete after 9 days. ( I am waiting for more storage)

I have it set in the Grid configuration to 9 days, but after applying the changes, it still shows the default 365 days in elasticsearch.

Do I have to delete the settings in the Global Override area before it will take effect?

[cm-ops]

Changing the index setting in SOC worked on my test machine:

[oneCrazyAdmin]

What is you setting in the global override? Here are mine and it says that they are default.

Also, what was the query that you ran to display the index settings from the command line?

[cm-ops]

I did not touch global_overrides when I change the setting for Zeek. To see changes to ES from the CLI, run sudo salt-call pillar.get elasticsearch