Deleting Old Activity

In ExaVault, history logs (activity logs) are stored in Elasticsearch and made searchable in the UI. Customers with large Elasticsearch datasets can purge older activity log data to improve performance.

If you want to preserve the old log data, make a backup of your VM before continuing.

To interact with Elasticsearch, first connect to your appliance via SSH. Once connected, open a shell inside the Elasticsearch container:

sudo docker exec -it exavault_elasticsearch_1 bash

Viewing Indexes

List the indexes containing daily activity logs by sending a curl command to Elasticsearch:

curl -X GET "localhost:9200/_cat/indices/audit-*?v=true&s=index&pretty"

This lists the daily audit indexes. All audit indexes are named using the format audit-YEAR.

Deleting Indexes

To delete an index, send an HTTP DELETE command to Elasticsearch with the name of the index:

curl -X DELETE "localhost:9200/audit-1990?pretty"

To delete more than one year, comma-separate the indexes. This deletes indexes 1990 and 1991:

curl -X DELETE "localhost:9200/audit-1990,audit-1991?pretty"