Enable curator to deleted old log data

Deletes data after 15 days

doc/user/clusters/applications.md

@@ -433,6 +433,8 @@ Filebeat will run as a DaemonSet on each node in your cluster, and it will ship
 GitLab will then connect to Elasticsearch for logs instead of the Kubernetes API,
 and you will have access to more advanced querying capabilities.
 
+Log data is automatically deleted after 15 days using [Curator](https://www.elastic.co/guide/en/elasticsearch/client/curator/5.5/about.html).
+
 This is a preliminary release of Elastic Stack as a GitLab-managed application. By default,
 the ability to install it is disabled.
 

vendor/elastic_stack/values.yaml

@@ -34,7 +34,35 @@ nginx-ldapauth-proxy:
   enabled: false
 
 elasticsearch-curator:
-  enabled: false
+  enabled: true
+  configMaps:
+    config_yml: |-
+      ---
+      client:
+        hosts:
+          - elastic-stack-elasticsearch-client
+        port: 9200
+    action_file_yml: |-
+      ---
+      actions:
+        1:
+          action: delete_indices
+          description: >-
+            Delete indices older than 15 days (based on index name), for filebeat-
+            prefixed indices. Ignore the error if the filter does not result in an
+            actionable list of indices (ignore_empty_list) and exit cleanly.
+          options:
+            ignore_empty_list: True
+          filters:
+          - filtertype: pattern
+            kind: prefix
+            value: filebeat-
+          - filtertype: age
+            source: name
+            direction: older
+            timestring: '%Y.%m.%d'
+            unit: days
+            unit_count: 15
 
 elasticsearch-exporter:
   enabled: false