# Applying ILM Policy but data not getting deleted

**URL:** <https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [September 15, 2020, 6:42am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605 "2020-09-15T06:42:24Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [September 15, 2020, 6:42am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/1 "2020-09-15T06:42:24Z")

</div>

Hello,

I am working on configuring an ILM policy to delete any data in an index which is older than 30 days / more than 50GB.

I have an index which has data about 97GB at the moment.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fdfafaf67ec51b44a9b293ad7bf25e4bf5c955e9.png)

I have configured an alias for this index as shown in the above image..

I have configured a ILM policy to perform rollover of index if any data is more than 50GB and then delete the data after 10 days...

Below is the setting of the same...

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f034871dd0155a6eee4edaffaf30821cc890f85b.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c46395e8a50096a5a98f661210317a2256a7c6fc.png)

I have then applied the above policy to the index which has data of 97GB.

However, even after applying the policy, I do not see the data being deleted from the index...

Could someone please let me know if the above configuration is correct or if I am missing anything ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2020, 6:47am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/2 "2020-09-15T06:47:40Z")

</div>

The ILM setting refers to primary shard size. The size you show include a replica so the primary shard is probably not 50GB yet as the total size is less than 100GB.

---

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [September 15, 2020, 7:11am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/3 "2020-09-15T07:11:41Z")

</div>

Ok....Thanks for the information...

Right now, if I refresh the index page, I see an error for the index...The error is as below :

`illegal_argument_exception: index name [ohsaccesslogsindex] does not match pattern '^.*-\d+$'`

Any action needed for this ?

Please note that : I am trying to configure ILM for an already existing old index...

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2020, 7:36am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/4 "2020-09-15T07:36:35Z")

</div>

The index the error is referring to does not seem to be a time-based one. ILM deletes complete indices so is usually used with time-based indices.

---

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [September 15, 2020, 7:53am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/5 "2020-09-15T07:53:08Z")

</div>

Ok...Does it mean I cannot apply ILM policies to a non-time based index ?

If yes, how can I proceed if I want to delete data from a non-time based index ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2020, 8:03am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/6 "2020-09-15T08:03:03Z")

</div>

You will need to set up and trigger delete by query operations yourself periodically.

---

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [September 15, 2020, 8:58am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/7 "2020-09-15T08:58:50Z")

</div>

Ok...Thanks...I was under an assumption that ILM can be applied to non-time based indices...

Could you please share some documentation on how to set up the trigger and delete the data based on custom requirements...??

Thanks in advance...

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2020, 9:02am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/8 "2020-09-15T09:02:03Z")

</div>

One way is to create a script that is triggered from from. I do not know of any docs showing this.

---

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [September 15, 2020, 9:05am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/9 "2020-09-15T09:05:39Z")

</div>

I had seem couple of blogs and came across the below which will delete eveything older than 2016-02-29

Could you please confirm if this would work or if any changes to be made to this ?

```auto
DELETE index_name/_query
{
  "query": {
    "filtered": {
      "query": {
        "query_string": {
          "query": "*"
        }
      },
      "filter": {
        "range": {
          "@timestamp": {
            "lte": "2016-02-29"
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [September 20, 2020, 2:52am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/10 "2020-09-20T02:52:01Z")

</div>

Hello,

How do I make sure that my index is a time-series index ?

Right now, I configured the logstash output section to create index in a certain way

( for ex : index ==\> "logfileindex" )

This has created the index named logfileindex...But I am unable to apply ILM to this since it is a non-time series based index...

How can I convert this index to a time-series based ?

If it cannot be converted, how do I create a time-series based index with my current settings ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2020, 2:52am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605/11 "2020-10-18T02:52:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
