How can I add a ilm policy to an existing datastream index

[Russell_Fulton]

Some how I have got an index (currently being written) in a data stream which does not have an ilm setting and therefore is not getting rolled over.

It is unclear to me what I should do. When I tried to close the index I got dire warnings about closing system indexes.

[warkolm (Mark Walkom)]

What is the name of the datastream?

[Russell_Fulton]

datastream name "Sec-events"

current index summary:

initial index summary:

[Russell_Fulton]

Over the weekend the index rolled over -- not a clue what was going on.

[Russell_Fulton]

actually I lie! I just found that it has not rolled over. I must have been looking at something else. Sigh...

So I decided to try closing the index to see if this would force ES to open a new one and was not too surprised to find that it didn't. I then realised that closing the index also kills reading so I went into kibana to try to reopen the index (list indexes -> select index -> click manage) and was surprised that there was now an option to add an ILM policy to the index which I did. The ILM section now appeared and showed action : rollover. Woohoo! But no new indexes appeared and my write to the data stream are still failing. So I open in kibana to reopen the index and viola! new index and I no more 500 errors in the ingestion processes!

So the answer to the original question "Some how I have got an index (currently being written) in a data stream which does not have an ilm setting and therefore is not getting rolled over" is:

1/. close the index
2/ assign the ilm policy to it
3/ reopen the index

caveat: you will loose any data being written to the index while is closed If you can pause ingestion without data loss you should. (I could not easily as the data coming in via syslog)