# FORCE index rollover

**URL:** <https://discuss.elastic.co/t/force-index-rollover/315958>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [October 6, 2022, 11:31am UTC](https://discuss.elastic.co/t/force-index-rollover/315958 "2022-10-06T11:31:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![frank\_rib](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_rib/32/104372_2.png) [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\
**Post date:** [October 6, 2022, 11:31am UTC](https://discuss.elastic.co/t/force-index-rollover/315958/1 "2022-10-06T11:31:28Z")

</div>

Hello,  
I sheep logs from multiples servers via the winlogbeat agent that are stored with index name ecs-agent-windows. This index is managed by a test0 policy (ILM) and configured with the agent-wingbeat template.

The logs are always added to ecs-agent-windows, even though the index is at the complete phase.

Is there any why to force the rollover the index with a new index name serie to resolve this issue from elasticsearch, knowing that I don’t have access to winlogbeat agent.

**The index settings**

```auto
> {
> "ecs-agent-windows": {
> "settings": {
> "index": {
> "lifecycle": {
> "name": "test0",
> "rollover_alias": "ecs-agent-windows1",
> "indexing_complete": "true"
> },
> "routing": {
> "allocation": {
> "include": {
> "_tier_preference": "data_warm,data_hot"
> }
> }
> },
> "number_of_shards": "1",
> "provided_name": "ecs-agent-windows",
> "creation_date": "1663002046263",
> "priority": "50",
> "number_of_replicas": "0",
> "uuid": "OgE-V8WVRBqW56Hwwmo5Bg",
> "version": {
> "created": "8030299"
> }
> }
> }
> }
> }

```

> **The policy settings**
> 
> > {  
> > "test0": {  
> > "version": 1,  
> > "modified\_date": "2022-10-05T17:17:50.872Z",  
> > "policy": {  
> > "phases": {  
> > "warm": {  
> > "min\_age": "1s",  
> > "actions": {  
> > "set\_priority": {  
> > "priority": 50  
> > }  
> > }  
> > },  
> > "hot": {  
> > "min\_age": "0ms",  
> > "actions": {  
> > "set\_priority": {  
> > "priority": 100  
> > },  
> > "rollover": {  
> > "max\_primary\_shard\_size": "50gb",  
> > "max\_age": "10m",  
> > "max\_docs": 500  
> > }  
> > }  
> > }  
> > }  
> > },  
> > "in\_use\_by": {  
> > "indices": [  
> > "ecs-agent-windows",  
> > "ecs-agent-filebeat-2022.10.05-000002",  
> > "ecs-agent-filebeat-2022.10.05-000001",  
> > "ecs-agent-filebeat"  
> > ],  
> > "data\_streams": ,  
> > "composable\_templates": [  
> > "ecs-agent-windows",  
> > "agent-filebeat",  
> > "agent-winlogbeat"  
> > ]  
> > }  
> > }  
> > }
> 
> The ILM explain:
> 
> ```auto
> > {
> > "indices": {
> > "ecs-agent-windows": {
> > "index": "ecs-agent-windows",
> > "managed": true,
> > "policy": "test0",
> > "index_creation_date_millis": 1663002046263,
> > "time_since_index_creation": "23.8d",
> > "lifecycle_date_millis": 1663002046263,
> > "age": "23.8d",
> > "phase": "warm",
> > "phase_time_millis": 1665015792294,
> > "action": "complete",
> > "action_time_millis": 1665016742506,
> > "step": "complete",
> > "step_time_millis": 1665016742506,
> > "phase_execution": {
> > "policy": "test0",
> > "phase_definition": {
> > "min_age": "1s",
> > "actions": {
> > "set_priority": {
> > "priority": 50
> > }
> > }
> > },
> > "version": 1,
> > "modified_date_in_millis": 1664990270872
> > }
> > }
> > }
> > }
> 
> ```

Best regards,

---

<div class="post-metadata">

**Author:** ![FALEN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/falen/32/82754_2.png) [@FALEN](https://discuss.elastic.co/u/FALEN)\
**Post date:** [October 6, 2022, 11:44am UTC](https://discuss.elastic.co/t/force-index-rollover/315958/2 "2022-10-06T11:44:34Z")

</div>

Hey, if i understood right you want to add rotation capability to your indices.

You can try adding date at the end of your indices name, so it would be limited with 24 hour. New logs will be added to new indices.

Just change your elasticsearch output within logstash config as below;

```auto
index => "ecs-agent-windows-%{+YYYY.MM.dd}"

```

---

<div class="post-metadata">

**Author:** ![frank\_rib](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_rib/32/104372_2.png) [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\
**Post date:** [October 6, 2022, 2:02pm UTC](https://discuss.elastic.co/t/force-index-rollover/315958/3 "2022-10-06T14:02:38Z")

</div>

Hi FALEN,

Thanks for you replay.  
The output of the winlogbeat agent not point to logstash, it store data directly in elasticsearch. My need is to rollover the index automaticaly via the ilm policy defined.

Best regards,

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 6, 2022, 2:08pm UTC](https://discuss.elastic.co/t/force-index-rollover/315958/4 "2022-10-06T14:08:58Z")

</div>

If you are not using Logstash, then you should edit the question and change the tag to direct it to the correct forum.

---

<div class="post-metadata">

**Author:** ![frank\_rib](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_rib/32/104372_2.png) [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\
**Post date:** [October 6, 2022, 2:35pm UTC](https://discuss.elastic.co/t/force-index-rollover/315958/5 "2022-10-06T14:35:30Z")

</div>

Hello leandrojmp,

It was a mistake, done.

Best regards,

---

<div class="post-metadata">

**Author:** ![frank\_rib](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_rib/32/104372_2.png) [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\
**Post date:** [October 7, 2022, 5:33pm UTC](https://discuss.elastic.co/t/force-index-rollover/315958/6 "2022-10-07T17:33:40Z")

</div>

Hello,  
Can I have an expert who can help me to solve this probleme

Regards,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 5:34pm UTC](https://discuss.elastic.co/t/force-index-rollover/315958/7 "2022-11-04T17:34:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.