Elastic ILM is not rolling

Elastic Stack Elasticsearch
1

Hello,

I have configured my ILM to rollover when the indice size be 20GB or after passing 30 days in the hot node as it's mentioned in this pic :

image
image1164×774 64.7 KB

but my indice passed 20GB and still didn't pass to the cold node:

image
image1181×49 5.61 KB

and when I run: GET _cat/indices?v I get:

green  open   packetbeat-7.9.2-2020.10.22-000001                         RRAnRZrrRZiihscJ3bymig  10   1   63833049            0     44.1gb           22gb

Knowing that in my packetbeat file configuration, I have just changed the number of shards:

setup.template.settings:
  index.number_of_shards: 10
  index.number_of_replicas: 1

when I run the command GET packetbeat-7.9.2-2020.10.22-000001/_settings I get something like that:

{
  "packetbeat-7.9.2-2020.10.22-000001" : {
    "settings" : {
      "index" : {
        "lifecycle" : {
          "name" : "packetbeat",
          "rollover_alias" : "packetbeat-7.9.2"
        },
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "mapping" : {
          "total_fields" : {
            "limit" : "10000"
          }
        },
        "refresh_interval" : "5s",
        "number_of_shards" : "10",
        "provided_name" : "<packetbeat-7.9.2-{now/d}-000001>",
        "max_docvalue_fields_search" : "200",
        "query" : {
          "default_field" : [
            "message",
            "tags",
            "agent.ephemeral_id",
            "agent.id",
            "agent.name",
            "agent.type",
            "agent.version",
            "as.organization.name",
            "client.address",
            "client.as.organization.name",

and the output of the command GET /packetbeat-7.9.2-2020.10.22-000001/_ilm/explain is :

{
  "indices" : {
    "packetbeat-7.9.2-2020.10.22-000001" : {
      "index" : "packetbeat-7.9.2-2020.10.22-000001",
      "managed" : true,
      "policy" : "packetbeat",
      "lifecycle_date_millis" : 1603359683835,
      "age" : "15.04d",
      "phase" : "hot",
      "phase_time_millis" : 1603359684332,
      "action" : "rollover",
      "action_time_millis" : 1603360173138,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1603360173138,
      "phase_execution" : {
        "policy" : "packetbeat",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 1,
        "modified_date_in_millis" : 1603359683339
      }
    }
  }
}

I see that the max_size=50gb but in kibana I had configured it to be 20gb as it's shown in the first picture.

Could you tell me how can I solve this problem please!
Thanks for your help

2

Can someone help me with this please !!

3

I solved my problem, thanks for @Vidit who helped me to figure out what was the problem.
So to solve my problem I had just to delete the policy from the index after that I edited the policy, and then added the index life policy for that index again.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.