Deletion time - index managed by ilm

Elastic Stack Elasticsearch
1

We are using this ILM:

PUT _ilm/policy/ilm-custom
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "set_priority": {
            "priority": 10
          }
        }
      },
      "warm": {
        "min_age": "1d",
        "actions": {
          "shrink": {
            "number_of_shards": 1
          }
        }
      },
      "delete": {
        "min_age": "5d",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": true
          }
        }
      }
    }
  }
}

The problem is the deletion phase, this deletion procedure start at 10:00h. At 09:00 h, we have an extra day in data nodes and space used increase reaching the 20% limit of data nodes.

What is the hour to deletion phases? Is possible to change it?

Regards,

2

I assume you are using daily indices absed on timestamp as you have no rollover clause. If this is the case you are deleting a full days worth of data at some point. Just before deletion you will have one days worth of data more than the policy specifies, so you need to account for this in your sizing. I believe the deletion is performed based on the creation date of the index. This is often based on UTC time, so when this happens would depend on the timezone you are in.

3

Yes, we use daily indices based in timestamp. And the deletion time is not after 5 days of index creation because a lot of these indices was created at 02.00 local hour and the deletion time at 10.00 h local time after 5 and half day.

Is not possible change it?

Regards,

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.