Data Loss/Unavailability in Elastic Search for querying after the ilm policy execution

I see there are documents in the index and writes are happening, yet I can't query. (attached image).

ilm policy: attached to indices.
PUT _ilm/policy/livestream_delete_policy
{
"policy": {
"phases": {
  "hot": {
"min_age": "0ms",
"actions": {
  "rollover": {
    "max_age": "12h"
  },
  "set_priority": {
    "priority": 100
  }
}
  },
  "delete": {
"min_age": "48h",
"actions": {
  "delete": {}
}
  }
}
}
} 

At every 48th hour, experiencing this problem of Data Unavailability. The index writes are happening, but reads doesn't show up, and Kibana returns blank (Discover/Search).

http://<host>:9200/livestream/_search
{
  "took": 305,
  "timed_out": false,
  "_shards": {
    "total": 80,
    "successful": 80,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 0,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  }
}

I have another (dev/test) environment, with a different ilm policy. Both writes and reads are happening without any issue. Only difference I have is 'delete after 12h rollover'

PUT _ilm/policy/livestream_delete_policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_age": "12h"
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "delete": {
        "min_age": "12h",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": true
          }
        }
      }
    }
  }
}

Result Json from test host.

{
  "took": 5754,
  "timed_out": false,
  "_shards": {
    "total": 30,
    "successful": 30,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 10000,
      "relation": "gte"
    },
    "max_score": null,
    "hits": []
  }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.