I want to keep 1 year of daily indexes but for the ones older than 30 days, unloaded from memory. But accessible when needed.

So like say there's a performance issue today and I want to compare all the activity against 2 months ago. I can open the old index and search it.

Can you do that, does closing remove it from memory? Otherwise how would you do that?

That's what the transaction log is for.

@SortOfTested what transaction log?

@donuts
https://elastic.co/guide/en/...

@SortOfTested I'm sort of confused, not sure how translog plays into this.

I have ELK setup to record a REST app's requests via filebeats and logstash.

Each day LS will store ask the data it gets into a new index yyyy.mm.dd.

I see ELASTIC using more RAM each day.

But it also seems to take up the equivalent disk space though so I'm thinking it stores a copy on disk too?

Can I unload the one in RAM but keep the data? And reload it when needed?

I see in the link it says in a crash data would be lost but when I restart ELK, the data is still there so I'm think it's loading from disk when it starts. But if the a way to tell ELASTIC which ones to load/ not load?

@donuts
Backup the transaction log long term, backup the database for 30 days