Data stream indices not moving from frozen to delete state

Elastic Stack Elasticsearch
1

I have created a data stream with ILM with phases ranging from Hot to Deleted.

The backing indices are successfully moved into Frozen state but never continue into the Deleted phase.

Why are the indices not moving to deleted state?

Here is the lifecycle policy:

{
  "filebeat" : {
    "version" : 11,
    "modified_date" : "2022-05-11T10:05:49.653Z",
    "policy" : {
      "phases" : {
        "frozen" : {
          "min_age" : "70m",
          "actions" : {
            "searchable_snapshot" : {
              "snapshot_repository" : "filebeat",
              "force_merge_index" : true
            }
          }
        },
        "warm" : {
          "min_age" : "30m",
          "actions" : {
            "set_priority" : {
              "priority" : 50
            }
          }
        },
        "cold" : {
          "min_age" : "50m",
          "actions" : {
            "set_priority" : {
              "priority" : 0
            }
          }
        },
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "20m"
            }
          }
        },
        "delete" : {
          "min_age" : "90m",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    },
    "in_use_by" : {
      "indices" : [
        ".ds-filebeat-data-stream2-2022.05.12-000056",
        ".ds-filebeat-data-stream2-2022.05.12-000055",
        ".ds-filebeat-data-stream2-2022.05.12-000058",
        ".ds-filebeat-data-stream2-2022.05.12-000057",
        ".ds-filebeat-data-stream-2022.05.06-000030",
        ".ds-filebeat-data-stream2-2022.05.12-000059",
        ".ds-filebeat-data-stream-2022.05.06-000031"
      ],
      "data_streams" : [
        "filebeat-data-stream2",
        "filebeat-data-stream"
      ],
      "composable_templates" : [
        "filebeat"
      ]
    }
  }
}

And here is the example of one backing index that is stuck in Frozen state:

    ".ds-filebeat-data-stream2-2022.05.11-000009" : {
      "index" : ".ds-filebeat-data-stream2-2022.05.11-000009",
      "managed" : true,
      "policy" : "filebeat",
      "lifecycle_date_millis" : 1652279563554,
      "age" : "1.26d",
      "phase" : "frozen",
      "phase_time_millis" : 1652284361763,
      "action" : "searchable_snapshot",
      "action_time_millis" : 1652284361763,
      "step" : "wait-for-index-color",
      "step_time_millis" : 1652285568765,
      "repository_name" : "filebeat",
      "snapshot_name" : "2022.05.11-.ds-filebeat-data-stream2-2022.05.11-000009-filebeat-u3zlsfkdt1kl1jm5yvdtca",
      "step_info" : {
        "message" : "index is not green; not all shards are active"
      },
      "phase_execution" : {
        "policy" : "filebeat",
        "phase_definition" : {
          "min_age" : "70m",
          "actions" : {
            "searchable_snapshot" : {
              "snapshot_repository" : "filebeat",
              "force_merge_index" : true
            }
          }
        },
        "version" : 11,
        "modified_date_in_millis" : 1652263549653
      }
    },
1 Like
2

Can you check _cat/inidces/.ds-filebeat-data-stream2-2022.05.11-000009?v?

3

Since I am using free version, I will not be able to create searchable snapshots. If I want the indices to be automatically removed, is this not possible? Do I need to manually delete them?

4

Yes, you need to manually remove them if you are using the open source version of Elasticsearch. You can use Curator as well.

5

Recent Elasticsearch versions are not compatible with the latest curator release:

Elasticsearch version 8.2.2 incompatible with this version of Curator (5.8.4)

Is there no other way to automatically delete older indices while using the open source version?

6

8.2 is free, but it not open source.

You can use ILM in 8.2.

7

8.2 is free, but it not open source.

Can I still use the 8.2 free version for unlimited usage with the free/base license?
From where would I get the latest open-source version?

You can use ILM in 8.2.

If I don't have the enterprise version, to my understanding, I still cannot use searchable snapshots so it will still not be possible to automatically delete indices?

8

The last open source version was 7.10.

Searchable Snapshots is a subscription feature, yes. ILM is a free one.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.