Elasticsearch - instructions to configure retention

[wioxjk]

Hi!

As someone that is not really an Elasticsearch-guru - setting up retention for the Haraka-logging in elasticsearch is quite a challenge.

I following the very clear instructions here, on about setting up the logging towards the Elasticsearch-server here:
https://haraka.github.io/plugins/log.elasticsearch/

But I am really struggling with configuring automatic deletion of logs after X amount of days.

How did you guys solve it? I was made aware of this when elasticsearch was full (999/1000 shards) and therefore was not logging correctly. I "fixed" this by increasing the shards on the installation.

[msimerson]

I solved this for myself by first: rolling up the existing shards into monthly shards instead of daily, and then configuring fewer shards per file.

[msimerson]

I have created a FAQ with some strategies I've used to manage my ES cluster.