I see there are documents in the index and writes are happening, yet I can't query. (attached image).
ilm policy: attached to indices.
PUT _ilm/policy/livestream_delete_policy
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "12h"
},
"set_priority": {
"priority": 100
}
}
},
"delete": {
"min_age": "48h",
"actions": {
"delete": {}
}
}
}
}
}
At every 48th hour, experiencing this problem of Data Unavailability. The index writes are happening, but reads doesn't show up, and Kibana returns blank (Discover/Search).
http://<host>:9200/livestream/_search
{
"took": 305,
"timed_out": false,
"_shards": {
"total": 80,
"successful": 80,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 0,
"relation": "eq"
},
"max_score": null,
"hits": []
}
}
I have another (dev/test) environment, with a different ilm policy. Both writes and reads are happening without any issue. Only difference I have is 'delete after 12h rollover'
PUT _ilm/policy/livestream_delete_policy
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "12h"
},
"set_priority": {
"priority": 100
}
}
},
"delete": {
"min_age": "12h",
"actions": {
"delete": {
"delete_searchable_snapshot": true
}
}
}
}
}
}
Result Json from test host.
{
"took": 5754,
"timed_out": false,
"_shards": {
"total": 30,
"successful": 30,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 10000,
"relation": "gte"
},
"max_score": null,
"hits": []
}
}