Thanks @Christian_Dahlqvist ,
My index was not time series index, post reindexing it I convert it into time series index and rollover is happening as per ilm policy and able to achieve the goal.
POST /_reindex
{
"source": {
"index": "weather"
},
"dest": {
"index": "weather-000001"
}
}
DELETE weather
Appying Alias on timeseries index, Queries can run on alias which will be the weather.
POST /_aliases
{
"actions": [
{
"add": {
"index": "weather-000001",
"alias": "weather",
"is_write_index": true
}
}
]
}
Logstash output-
output {
stdout {
codec => rubydebug
}
elasticsearch {
ilm_rollover_alias => "weather"
ilm_pattern => "000001"
ilm_policy => "weather"
hosts => ["localhost:9200"]
One Query-
If we query (using an index pattern) for the last 3 days of data in an index that has rollover set to daily, does the query run only on the latest 3 indices or does it run on all?
I guess we need to specify the indices names in the query to limit to search to only the last 3 indices. Doesn't it happen automatically? Or does it happen automatically in the data stream but not in the index alias/ pattern?
If we have 10 days of data with daily rollover.
Sample query-
GET weather-*/_search
{
"query": {
"range": {
"@timestamp": {
"gte": "now-3d"
}
}
}
}
Ref link-
Index lifecycle error - illegal_argument_exception: index.lifecycle.rollover_alias
Manage existing indices | Elasticsearch Guide [7.15] | Elastic
Data rollover in Elasticsearch