logs retention automatically

[mahmoudelhaj]

Hi,

my question,
How to set the limit to all logs ingested from Firewalls to 100G only, if new logs ingested from firewalls, ES should make logs retention automatically and remove oldest logs.

Q1 can we do this using index templates and how?

[cm-ops]

What is your Elasticsearch grid? Are you using cross-cluster or true cluster?

[mahmoudelhaj]

I used so manager as remote & so search as storage

[cm-ops]

Let me ask this a different way. What is the output of salt-call pillar.get elasticsearch:true_cluster?

[mahmoudelhaj]

[cm-ops]

You have a cross cluster configuration, your indices are cleaned up based on log_size_limit currently. That setting is in the minion pillar file. You can also see it with salt-call pillar.get elasticsearch:log_size_limit. Curator is used to trim disk space is SO and in your configuration the action will occur when disk space threshold is met. This is for all indices except so-case.

[mahmoudelhaj]

THNX