I want to keep 1 year of daily indexes but for the ones older than 30 days, unloaded from memory. But accessible when needed.

So like say there's a performance issue today and I want to compare all the activity against 2 months ago. I can open the old index and search it.

Can you do that, does closing remove it from memory? Otherwise how would you do that?

  • 0
    That's what the transaction log is for.
  • 0
    @SortOfTested what transaction log?
  • 0
  • 0
    @SortOfTested I'm sort of confused, not sure how translog plays into this.

    I have ELK setup to record a REST app's requests via filebeats and logstash.

    Each day LS will store ask the data it gets into a new index yyyy.mm.dd.

    I see ELASTIC using more RAM each day.

    But it also seems to take up the equivalent disk space though so I'm thinking it stores a copy on disk too?

    Can I unload the one in RAM but keep the data? And reload it when needed?
  • 0
    I see in the link it says in a crash data would be lost but when I restart ELK, the data is still there so I'm think it's loading from disk when it starts. But if the a way to tell ELASTIC which ones to load/ not load?
  • 0
    Backup the transaction log long term, backup the database for 30 days
Add Comment