One nice feature of the logstash-elasticsearch integration is that, by default, logstash will use timestamped indices when feeding data to elasticsearch.
This means that yesterday's data is in a separate index from today's data and from each other day's data, simplifying index management. For instance, suppose you only want to keep the last 30 days:
elasticsearch-remove-old-indices.sh -i 30
The Apache Camel Elasticsearch component provides no such feature out of the box, but luckily it is quite easy to implement (when you know what to do. /grin ).
- ▼ 2015 (11)
- ► 2013 (10)
- ► 2012 (35)
- ► 2011 (18)