Hot/Warm/Cold phases being ignored. Data goes directly to Cold

Elastic Stack Elasticsearch
, ,
1

Hello,

As the title says, all my streams share a common ILM policy but somehow it is ignored.

image
image1259×853 90.9 KB

All nodes are capable of hot/warm/cold. It is a recent setup and we don't have separate roles yet.

image
image567×244 9.64 KB

Any pointer to what could be happening here?

2

You need to share your policy, it is impossible to troubleshoot without seeing it.

Share a screenshot of the policy in Kibana and the raw json as well.

3 
PUT _ilm/policy/deusto-ilm-policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "set_priority": {
            "priority": 100
          }
        }
      },
      "warm": {
        "min_age": "1d",
        "actions": {
          "set_priority": {
            "priority": 50
          }
        }
      },
      "cold": {
        "min_age": "2d",
        "actions": {
          "readonly": {},
          "set_priority": {
            "priority": 0
          }
        }
      },
      "delete": {
        "min_age": "60d",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": true
          }
        }
      }
    }
  }
}

image
image1287×915 96 KB

4

From what you shared, I'm not sure there is any issue.

Your lifecycle policy does not have a rollover, it has a warm phase tha will trigger after one day of the creation of the index, and a cold phase that will trigger after two days of the creation of the index.

If any index is older than 2 days they will be in cold.

It is also not clear if you are using normal indices or data streams, can you share the result of running GET _cat/indices in Kibana Dev Tools?

I'm not sure how the Streams app works, so I'm not sure if this could lead to any issues, but if all indices have the same role, it does not make any sense to have ILM with data tiering, you should have dedicated warm and cold indices for this to make sense.

5

image
image901×185 83.1 KB

I see what may be happening. The datastreams are not rolling daily into different indexes and thus not following the ILM as I expect. Is that so?

How I make the datastreams behave like I expect?

Thank you very much!

PS:

if all indices have the same role, it does not make any sense to have ILM with data tiering, you should have dedicated warm and cold indices for this to make sense.

I believe, but I could be wrong, that a cold index consumes less resources than a hot index. The ILM policy right now is just for that, though maybe in the future we should dedicate nodes to cold data retention.