<p>I am creating an EFK stack on a k8s cluster. I am using an EFK helm chart described <a href="https://akomljen.com/get-kubernetes-logs-with-efk-stack-in-5-minutes/" rel="nofollow noreferrer">here</a>. This creates two PVC's: one for es-master and one for es-data.</p>

<p>Let's say I allocated 50 Gi for each of these PVC's. When these eventually fill up, my desired behavior is to have new data start overwriting the old data. Then I want the old data stored to, for example, an s3 bucket. How can I configure Elasticsearch to do this?</p>

<p>One easy tool that can help you do that is Elasticsearch Curator:
<a href="https://www.elastic.co/guide/en/elasticsearch/client/curator/5.5/actions.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/elasticsearch/client/curator/5.5/actions.html</a></p>
<p>you can use it to:</p>
<ol>
<li>Rollover the indices that hold the data, by size/time. This will cause each PVC to hold few indices, based on time.</li>
<li>snapshot the rolled over indices to backup in S3</li>
<li>delete old indices based on their date - delete the oldest indices in order to free up space for the new indices.</li>
</ol>
<p>Curator can help you do all these.</p>
