Run ISM Policy Opensearch with query

i want to create policy to delete logs base on "expired_time" field in index.
Example:

index: my-log

data:

{
"logText":"message text",
"expired_time": "2024-02-01T14:33:33.290+00:00"
}

As i research, it can only be deleted by pattern index. So anyway i can process it?

Using: opensearch 1.0.1

There was a _ttl field to delete documents after the retention period. But the feature is removed.

> The _ttl mappings have been removed. As a replacement for _ttl
> mappings, we recommend using ILM (ISM in Opensearch) to create time-based indices.

What you can do?

You can use _delete_by_query API to remove documents older than X times. It can make sense to trigger this query per hour.

An example:

POST index_name/_delete_by_query?conflicts=proceed
{
  "query": {
    "range": {
      "expired_time": {
        "lt": "now"
      }
    }
  }
}