Ability to delete rollover indices based on criteria from all documents

[dakrone]

When someone switches from daily indices to indices based on a rollover policy
(say, number of documents or index size), they lose the ability to easily expire
data based on the timestamp of when the data was written. For example, with the
following indices:

• test-2018-01-01
• test-2018-01-02
• test-2018-01-03

It's easier to delete all data before the 3rd of January by deleting the
test-2018-01-01 and test-2018-01-02 indices.

With the rollover API however, things will be slightly different (assuming no
date math in index names):

• test-000001
• test-000002
• test-000003
• test-000004

I think it would be nice if there were a way to say something like "delete
indices where all data is older than XYZ"

For example:

POST /test-*/_delete_index_by_query
{
  "query": {
    "range": {
      "@timestamp": {
        "lt": "2018-01-03"
      }
    }
  }
}

Which could examine the data in the test-* indices (either through the Lucene
stats or by querying the data directly) to know the max/min of the @timestamp
field. It could then know to delete the test-000001 and test-000002 indices,
for example. Other indices could be ignored.

[elasticmachine]

Pinging @elastic/es-core-infra

[joegallo]

I'm removing the team-discuss label from some older Team:Data Management issues -- we've had plenty of time to discuss them, but we haven't, so the label isn't serving its purpose. Feel free to delete this comment and/or re-add the team-discuss label.

[elasticsearchmachine]

Pinging @elastic/es-data-management (Team:Data Management)