Elasticsearch ILM Deleting an index is just a logical drop, but the index can still be used. Will it eventually be physically deleted

[liuliugang]

View index lifecycle management in Kibana The current phase is Delete and the current action is Complete

thanks

[warkolm (Mark Walkom)]

It's not clear what you mean here sorry, can you please elaborate?

[liuliugang]

LIM is used to manage the index life cycle, while indexes in the drop phase can still be queried.

The index status is as follows

[warkolm (Mark Walkom)]

What does your policy look like?
What version are you running?

[liuliugang]

elasticsearch 7.10.0 kibana 7.10.0
LIM only keeps indexes for 1 minute after configuring them in Kibana

The LIM configuration is as follows
PUT _ilm/policy/access_test
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"set_priority": {
"priority": 100
}
}
},
"delete": {
"min_age": "1m",
"actions": {}
}
}
}
}

The index template is as follows
PUT _template/access_test
{
"order": 5,
"version": 60001,
"index_patterns": [
"access-test-*"
],
"settings": {
"index": {
"number_of_shards": "3",
"number_of_replicas": "1",
"refresh_interval": "30s",
"max_result_window": "300000"
}
},
"mappings": {
"dynamic": "false",
"properties": {
"name": {
"type": "keyword"
},
"age": {
"type": "long"
}
}
},
"aliases": {}
}

[liuliugang]

Please give your comment,thanks.

[Christian_Dahlqvist]

Your delete stage does not seem to have a delete action which could be why the index is not deleted.

[liuliugang]

Thank you very much.I configured and copied the request API through the Kibana graphical interface, and I can see from the Kibana Index Lifecycle Management that the index drop operation has been completed.
How should I adjust it, please

[liuliugang]

• Thank you. I found the reason

PUT _ilm/policy/access_policy
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {}
},
"delete": {
"min_age": "2m",
"actions": {
"delete": {
"delete_searchable_snapshot": true
}
}
}
}
}
}

[warkolm (Mark Walkom)]

There was a bug in 7.11 or 7.12 I think that cause this, upgrading will fix it.

[liuliugang]

I think there is a missing line of code in the official documentation example. When I added it, the index was deleted normally

• Here is a screenshot of the official manual
  
  

[warkolm (Mark Walkom)]

That screenshot shows the delete action under the phase, so it is correct.
I would suggest upgrading.

[liuliugang]

My version of Elasticsearch is 7.10.0
Do you mean that the presence or absence of this parameter ("delete_searchable_snapshot": true) does not affect index deletion

[warkolm (Mark Walkom)]

No it does not.

You had this in your policy above;

@liuliugang

"delete": {
"min_age": "1m",
"actions": {}

And per the docs it should have been;

"delete": {
    "min_age": "1m",
    "actions": {
        "delete" : { }
    }

You were missing the second delete decleration.

As I mentioned, there was a bug in earlier versions of Kibana that meant while an ILM policy was created, it didn't include that delete in the action. Hence why upgrading will fix it.

[liuliugang]

This is probably a bug in the current version of Kibana (7.10.0)

[warkolm (Mark Walkom)]

Yep, that's what I was saying.

[liuliugang]

Ok, thank you