A quick question about timing under the delete phase in the ILM policy. Right now (in Kibana), timing for the delete phase has only two options:
-
days from rollover
-
hours from rollover
Let's say the hot phase is set up to roll over every 20GB or 7 days into the warm phase. And, let's say that I'm hitting the threshold of 20GB faster than the threshold of 7 days. To make it simpler, let's assume I'm ingesting more/less of 10GB per day, so the index would roll over every two days (into the warm phase).
There is no cold storage.
And now, the delete phase. Since the delete phase has only two options for deleting older indexes, how can I set it up to have retention of let's say 14 days?
Since I'm rolling over my index every two days (based on the 20GB threshold and not age), and this could change to 1, 2, 3, 4, 5, 6, and finally 7 days (the max number of days), how can I set up the delete phase if I don't know which threshold gets hit first (index size or age)? Right now, I feel like the delete phase could only be set up correctly if the index rolled over based on the age not size from the hot to warm phase.
Example:
index: proxy_logs
hot phase: 20GB/7d
warm phase: 20GB in 1/2/3 days
cold phase: none
delete phase: 7 days from rollover
Since the index can roll over between 1 and 7 days, there is no way for me to set up the delete phase to 14 days, is that correct?