Deleting Old Activity

ExaVault stores Activity records in Elasticsearch and makes them searchable in the web interface. Removing old records can reduce the size of a large Elasticsearch dataset.

Deleting an audit index permanently removes all Activity records for that year. Back up the virtual machine before continuing if you may need those records later.

To interact with Elasticsearch, first connect to your appliance via SSH. Once connected, open a shell inside the Elasticsearch container:

sudo docker exec -it exavault_elasticsearch_1 bash

Viewing Indexes

List the annual audit indexes:

curl -X GET "localhost:9200/_cat/indices/audit-*?v=true&s=index&pretty"

Audit indexes use the name audit-YEAR.

Deleting Indexes

To delete an index, send an HTTP DELETE command to Elasticsearch with the name of the index:

curl -X DELETE "localhost:9200/audit-1990?pretty"

To delete more than one year, comma-separate the indexes. This deletes indexes 1990 and 1991:

curl -X DELETE "localhost:9200/audit-1990,audit-1991?pretty"