"Custom Rollover" index name in ILM policy configuration

Elastic Stack Elasticsearch
1

Hi Team,

I wanted to know if there is any way where I can specify the roll_over index name in the ILM policy. I see only condition parameter supported.

"logs-hotwarm-policy" : {
  "version" : 2,
  "modified_date" : "xxxx-xx-xxT12:18:03.706Z",
  "policy" : {
    "phases" : {
      "hot" : {
        "min_age" : "0ms",
        "actions" : {
         "rollover" : {
            "max_age" : "30d"
          },
          "set_priority" : {
            "priority" : 100
          }
        }
      },
      "warm" : {
        "min_age" : "1d",
        "actions" : {
          "allocate" : {
            "number_of_replicas" : 1,
            "include" : { },
            "exclude" : { },
            "require" : { }
          },
          "forcemerge" : {
            "max_num_segments" : 1
          },
          "readonly" : { },
          "set_priority" : {
            "priority" : 75
          },
          "shrink" : {
            "number_of_shards" : 1
          }
        }
      }
   }
}

}

I have the case, where I want to keep all the logs of the last 30 days into the "active" alias. Which I will be able to do with date-index-pattern ingest pipeline to create index based on incoming document field value so the index name will be like "logs-2019-04". And all the active "logs-*" indexes will point to "active-logs" alias.

So, for the next month the logs will automatically going to create new index based on ingest pipeline. Now I want to shift my "active-logs" alias to next month's index which will be like "logs-2019-05" and one more alias of "inactive-logs" which is going to point to "logs-2019-04".

2

Hi Hitesh,

You can control the name of the rolled over index by using index date math when you first create the index, for example:

// This is an escaped version of "/<logs-{now/m{yyyy-MM}}-1>"
PUT /%3Clogs-%7Bnow%2Fm%7Byyyy-MM%7D%7D-1%3E
{
  "aliases": {
    "your-alias":{
      "is_write_index": true
    }
  }
}

So it will create logs-2019-04-1 and then logs-2019-05-000002, then logs-2019-06-000003 (etc, assuming you roll over every month) when ILM rolls over the index.

You can see an example at https://www.elastic.co/guide/en/elasticsearch/reference/7.x/indices-rollover-index.html#_using_date_math_with_the_rollover_api

3

thanks @dakrone. I will definately check this.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.