I had something similar happen that made my data dirty - I wrote up a short post on it here that might help get you started down the road. The short is that I created a curl command that would find messages with a particular field:data
combination and I deleted it. Shouldn’t be that hard to modify it for a date range.
Assuming that this is enough to magically make it work for you, make sure you post back what your solution was for future searchers!!!
EDIT: The link to the script you posted has at it’s core something similar to my curl command - results may vary per elastic version you are on.
If you don’t mind loosing all the historical data, the cleanest way to do it is as you suggest, shorten the retention to a day and rotate your index manually. That way you can avoid scripts and curl etc…