How to access old indices from rollover alias after rollover in ES 7.16

Elastic Stack Elasticsearch
1

I have a template and policy to rollover and delete the indexes after 2 days but after rollover old indices will not be pointing to rollover alias and will have data that will be needed for 2 more days.

Template:

{
  "my-index_template" : {
    "order" : 0,
    "index_patterns" : [
      "my-index*"
    ],
    "settings" : {
      "index" : {
        "lifecycle" : {
          "name" : "my-index_policy",
          "rollover_alias" : "my-index-rollover"
        },
        "codec" : "best_compression"
      }
    },
    "mappings" : { },
    "aliases" : {
      "my-index" : { }
    }
  }
}

Policy:

{
  "my-index_policy" : {
    "version" : 10,
    "modified_date" : "2022-08-28T05:18:04.789Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_age" : "2d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "2d",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      },
      "_meta" : {
        "description" : "used for my-app kubernetes application",
        "project" : {
          "name" : "my-app",
          "department" : "abc"
        }
      }
    },
    "in_use_by" : {
      "indices" : [
        "my-index-000001"
      ],
      "data_streams" : [ ],
      "composable_templates" : [ ]
    }
  }
}

For the first index "my-index-000001", I am able to write by alias "my-index" but after rollover it says no write index found.
At the same time I am able to write with alias "my-index-rollover" to new index but cannot access old indices from this alias.

Is it possible to access old and new indices (rollover index) from the same alias and able to write to new index from same alias?

2

You can never write to an alias that points to more than a single index, so in your case my-index-rollover should be used for all writes and my-index for reading. With rollover you always write to the newest index and rollover may be hard to use if your data is not immutable.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.