APM Index name has numbers

Elastic Observability APM
1

As per
https://www.elastic.co/guide/en/apm/server/7.7/elasticsearch-output.html index name should be "apm-%{[observer.version]}-{type}-%{+yyyy.MM.dd}" (for example, "apm-7.7.1-transaction-2020-06-08" ). however I am running APM, ES and Kibana uing helm chart and haven't changed index configuration at all but I see index getting created as apm-7.6.2-transaction-000001.

Can anyone please tell me why is it happening. I like to enable ILM to delete 10 days old indices but I am wondering if I set that would it work?

Regards
Rohit

2

Hi @Rohit_Shrivastava,

this is something I also encountered recently. It is because of this

ILM is enabled by default, and the default policy will be applied to all APM indices as long as all of the following conditions are true:

The Elasticsearch instance supports ILM.
output.elasticsearch is enabled.
Custom index or indices settings are not configured.

So, ILM is enabled and you can configure the policy in Kibana or in the APM server config.

3

yes ILM is enabled but I was concerned will it work properly if I the index name doesn't have dates but number. And why do I have numbers and not dates if docs says thats the default.

4

When you use ILM the index rollover or versioning is not fixed time based anymore. So the date is replaced by a "counter". The ILM policy decides when the index is rolled over (time or size based).

I guess the idea is that you have size based rollover so that you know how large each index will be, which will help to optimize shard counts and shard size.

2 Likes
5

Thanks A_B!

6

Thanks @A_B for jumping in! That's correct.

I can see how these docs are confusing. I've opened #3870 to improve them.

7

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.