Estimated time to read: 1 minute

Experimental-feature notice

This page discusses experimental features. Experimental features are still in progress, and you may encounter bugs or unexpected behavior when using them.

If you experience an issue or want to know more about this feature's status, reach out to us at Era Software.

Acquisition notice

In October 2022, ServiceNow acquired Era Software. The documentation on this site is no longer maintained and is intended for existing Era Software users only.

To get the latest information about ServiceNow's observability solutions, visit their website and documentation.

This command removes data from an index past a provided time duration.


This command requires delete access to any indices issued against.

usage: eractl retention-delete [-h] [--url URL] [--key KEY] --really index duration

positional arguments:
  index       Index to remove data from
  duration    Duration to delete data from (ie, remove data past this duration)

optional arguments:
  -h, --help  show this help message and exit
  --url URL       EraSearch URL, set via environment with ERACTL_URL (default: http://localhost:9200)
  --key KEY       EraSearch API key, set via environment with ERACTL_API_KEY (default: None)
  --really    Are you sure? (default: False)

To run:

eractl retention-delete --url --key ****** my-index 24h --really

Or to pass arguments from the environment:

export ERACTL_URL=""
export ERACTL_API_KEY="******"
eractl retention-delete my-index 24h --really

Last update: August 7, 2023