CLI clearing data from xx days ago to free up space

[divadiow]

We haven't nailed our retention policy so when our LME VM has run out of space we can no longer sign in to adjust the retention.

Is there an easy cli way to remove all, or preferably, logs from x days ago and older, so we can free space?

[aarz-snl]

You should be able to look into doing this with the api:

curl -k -u elastic:password https://ipaddress:9200/_cat/indices

then after finding indices you want do delete:

curl -k -X DELETE -u elastic:password https://ipaddress:9200/INDEX_NAME

see more in docs here:

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html