elastic/curator

Permit staged expiration: open -> closed -> deleted

jordansissel opened this issue · 1 comments

http://www.elasticsearch.org/guide/reference/api/admin-indices-open-close/

Closed indexes incur basically no run-time resource usage and reads/writes to them should fail.

Closing an index before deleting it allows you to make it unsearchable before you finally purge it. This can be useful in panicked situations where you might need that data you thought you deleted.

Scenario: Want 90 days of logs.

  • close logs older than 90 days
  • delete logs older than 120 days

This gives you a 30 day window to go "oops!" and recover anything closed if you need it but otherwise only consumes disk space (but not other resources) until deleted.

This issue is closed now.