Datastream and indices not rolled over or deleted

Elastic Stack Kibana
1

Hi,

I recently started using datastreams, however, I see that the datastream and indices are not getting deleted according to the lifecycle policy. I can't seem to figure out why they are not getting deleted. Any help or advice will be appreciated.

Template

{
  "index_templates" : [
    {
      "name" : "logstash-template",
      "index_template" : {
        "index_patterns" : [
          "logstash-*"
        ],
        "template" : {
          "settings" : {
            "index" : {
              "lifecycle" : {
                "name" : "logstash-lifecycle-policy",
                "rollover_alias" : "logstash"
              },
              "number_of_shards" : "3",
              "number_of_replicas" : "0"
            }
          }
        },
        "composed_of" : [ ],
        "priority" : 1,
        "data_stream" : {
          "hidden" : false
        }
      }
    }
  ]
}

Policy

{
  "logstash-lifecycle-policy" : {
    "version" : 3,
    "modified_date" : "2021-10-14T09:11:03.611Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_primary_shard_size" : "25gb",
              "max_age" : "2d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "14d",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    },
    "in_use_by" : {
      "indices" : [
        ".ds-logstash-2021.09.23-2021.09.23-000001",
        ".ds-logstash-2021.10.07-2021.10.13-000002",
        ".ds-logstash-2021.10.04-2021.10.13-000002",
        ".ds-logstash-2021.10.12-2021.10.14-000002",
        ".ds-logstash-2021.10.02-2021.10.13-000002",
        ".ds-logstash-2021.10.12-2021.10.12-000001",
        ".ds-logstash-2021.10.08-2021.10.08-000001",
        ".ds-logstash-2021.10.05-2021.10.13-000002",
        ".ds-logstash-2021.09.23-2021.10.13-000002",
        ".ds-logstash-2021.10.08-2021.10.13-000002",
        ".ds-logstash-2021.10.11-2021.10.13-000002",
        ".ds-logstash-2021.10.01-2021.10.13-000002",
        ".ds-logstash-2021.09.26-2021.10.13-000002",
        ".ds-logstash-2021.10.14-2021.10.14-000001",
        ".ds-logstash-2021.09.29-2021.10.13-000002",
        ".ds-logstash-2021.09.29-2021.09.29-000001",
        ".ds-logstash-2021.10.11-2021.10.11-000001",
        ".ds-logstash-2021.10.07-2021.10.07-000001",
        ".ds-logstash-2021.10.01-2021.10.01-000001",
        ".ds-logstash-2021.09.30-2021.09.30-000001",
        ".ds-logstash-2021.10.04-2021.10.04-000001",
        ".ds-logstash-2021.09.26-2021.09.26-000001",
        ".ds-logstash-2021.10.09-2021.10.09-000001",
        ".ds-logstash-2021.09.25-2021.10.13-000002",
        ".ds-logstash-2021.10.13-2021.10.13-000001",
        ".ds-logstash-2021.10.03-2021.10.13-000002",
        ".ds-logstash-2021.10.10-2021.10.13-000002",
        ".ds-logstash-2021.09.28-2021.09.28-000001",
        ".ds-logstash-2021.10.03-2021.10.03-000001",
        ".ds-logstash-2021.10.10-2021.10.10-000001",
        ".ds-logstash-2021.10.06-2021.10.06-000001",
        ".ds-logstash-2021.09.22-2021.10.13-000002",
        ".ds-logstash-2021.09.30-2021.10.13-000002",
        ".ds-logstash-2021.09.25-2021.09.25-000001",
        ".ds-logstash-2021.09.22-2021.09.22-000001",
        ".ds-logstash-2021.09.28-2021.10.13-000002",
        ".ds-logstash-2021.09.27-2021.09.27-000001",
        ".ds-logstash-2021.10.02-2021.10.02-000001",
        ".ds-logstash-2021.10.05-2021.10.05-000001",
        ".ds-logstash-2021.09.21-2021.09.21-000001",
        ".ds-logstash-2021.09.24-2021.09.24-000001",
        ".ds-logstash-2021.09.24-2021.10.13-000002",
        ".ds-logstash-2021.10.06-2021.10.13-000002",
        ".ds-logstash-2021.09.21-2021.10.13-000002",
        ".ds-logstash-2021.09.27-2021.10.13-000002",
        ".ds-logstash-2021.10.09-2021.10.13-000002"
      ],
      "data_streams" : [
        "logstash-2021.09.21",
        "logstash-2021.10.11",
        "logstash-2021.10.12",
        "logstash-2021.10.10",
        "logstash-2021.10.13",
        "logstash-2021.10.14",
        "logstash-2021.10.08",
        "logstash-2021.10.09",
        "logstash-2021.10.06",
        "logstash-2021.10.07",
        "logstash-2021.09.22",
        "logstash-2021.09.23",
        "logstash-2021.09.24",
        "logstash-2021.09.25",
        "logstash-2021.09.26",
        "logstash-2021.09.27",
        "logstash-2021.09.28",
        "logstash-2021.09.29",
        "logstash-2021.09.30",
        "logstash-2021.10.01",
        "logstash-2021.10.04",
        "logstash-2021.10.05",
        "logstash-2021.10.02",
        "logstash-2021.10.03"
      ],
      "composable_templates" : [
        "logstash-template"
      ]
    }
  }
}
2

What's the current status of the policy?

3

Are you referring to ILM status?

{
  "operation_mode" : "RUNNING"
}
4

I should have said explain, not status, ie Explain lifecycle API | Elasticsearch Guide [7.15] | Elastic

5

Here is the explain output from one of the older indices that should have been deleted by now.

GET .ds-logstash-2021.09.25-2021.09.25*/_ilm/explain

 {
  "indices" : {
    ".ds-logstash-2021.09.25-2021.09.25-000001" : {
      "index" : ".ds-logstash-2021.09.25-2021.09.25-000001",
      "managed" : true,
      "policy" : "logstash-lifecycle-policy",
      "lifecycle_date_millis" : 1634112350860,
      "age" : "6.25d",
      "phase" : "hot",
      "phase_time_millis" : 1632528000684,
      "action" : "complete",
      "action_time_millis" : 1634112365782,
      "step" : "complete",
      "step_time_millis" : 1634112365782,
      "phase_execution" : {
        "policy" : "logstash-lifecycle-policy",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_primary_shard_size" : "25gb",
              "max_age" : "2d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "version" : 3,
        "modified_date_in_millis" : 1634202663611
      }
    }
  }
}
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.