How can i do a manual rollover for all indices to the newest index policy?

Elastic Stack Elasticsearch
1

Is it possible to force a rollover for my indices to the latest updated policy? So they would be in the correct phase?

GET _ilm/policy/netlogstash_policy

{
  "netlogstash_policy": {
    "version": 1,
    "modified_date": "2024-02-15T21:10:11.004Z",
    "policy": {
      "phases": {
        "warm": {
          "min_age": "7d",
          "actions": {
            "set_priority": {
              "priority": 50
            }
          }
        },
        "cold": {
          "min_age": "14d",
          "actions": {
            "set_priority": {
              "priority": 0
            }
          }
        },
        "hot": {
          "min_age": "0ms",
          "actions": {
            "set_priority": {
              "priority": 100
            },
            "rollover": {
              "max_age": "30d",
              "max_primary_shard_size": "50gb"
            }
          }
        },
        "delete": {
          "min_age": "30d",
          "actions": {
            "delete": {
              "delete_searchable_snapshot": true
            }
          }
        }
      }
    },
    "in_use_by": {
      "indices": [
        "netlogstash-2024.01.29"
      ],
      "data_streams": [],
      "composable_templates": [
        "netlogstash_template"
      ]
    }
  }
}

the indice

GET netlogstash-2024.01.29/_ilm/explain

{
  "indices": {
    "netlogstash-2024.01.29": {
      "index": "netlogstash-2024.01.29",
      "managed": true,
      "policy": "netlogstash_policy",
      "index_creation_date_millis": 1706536822224,
      "time_since_index_creation": "17.31d",
      "lifecycle_date_millis": 1708032747445,
      "age": "6.94m",
      "phase": "hot",
      "phase_time_millis": 1708032371263,
      "action": "complete",
      "action_time_millis": 1708032747446,
      "step": "complete",
      "step_time_millis": 1708032747446,
      "phase_execution": {
        "policy": "netlogstash_policy",
        "phase_definition": {
          "min_age": "0ms",
          "actions": {
            "set_priority": {
              "priority": 100
            },
            "rollover": {
              "max_age": "30d",
              "max_primary_shard_size": "50gb"
            }
          }
        },
        "version": 1,
        "modified_date_in_millis": 1708031411004
      }
    }
  }
}

im sorry, im new to elastic. Does doing a rollover to an index means to update it to the current phase per the configured ILM? In this example it should be at the "cold" phase.

Thank you!

2

HI @idan_amar Welcome to the community.

Looks to me the index is about 17days old

BUT the index has not rolled over... Because as defined I'm your policy it needs to be 30dayd or 50GB

All subsequent phases are calculated from rollover... Not creation... Common confusion...

The clock does not start for warm / cold etc until rollover.

You can manually rollover the index or set the rollover to a smaller time range . The current index even if you change the policy will be picked up when you rollover..

3

im sorry for the ignorance but what does "rollover" actually do?

Do i need to do this action to any index i apply to a ILM policy?

4

Remove the index as the write index for the rollover alias and start indexing to a new index.
Rolls over a target to a new index when the existing index satisfies the specified rollover conditions.

But looks like you are writing Daily Indices so no, you probably do not need rollover... even though it would probably be better in the long run.

No, it is one method to optimize ILM.

You look to be using daily indices so you do not need rollover... you can / should take it out... but I am not sure if that will help the existing index.

You may be in a strange state...

So take it (the rollover section) out of the ILM policy...

I think you will also need to set this...

wait ten minutes and then run the ILM explain again...

Also run this and show the settings section need to see if there is an write
GET netlogstash-2024.01.29

Lets see what happens

Unfortunately it does not look like you set this up correctly in the first place..

I highly recommends reading the documentation...

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.