We have an index that was created without a lifecycle policy — and it’s taking up about 300GB of our 1.5T on the dev server. I don’t want to delete it — mostly because I don’t know why it’s there. But cleaning up old data seemed like a
POST /metricbeat_kafka-/_delete_by_query
{
"query": {
"range" : {
"@timestamp" : {
"lte" : "2021-02-04T01:47:44.880Z"
}
}
}
}