How to rollover index that is ending with date

Elastic Stack Elasticsearch
1

Hi,

I have some indices in the cluster that have index names as follows:
abc-asd-2023-10-09
abc-asd-2023-10-10
abc-asd-2023-10-11

There is no function running in the cluster to create daily indices.
I wanted to add these indices to the ILM policy, but it didn't work. Because ILM is asking for "rollover aliases".
I got an error:
illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [index name] is empty or not defined

So how can I resolve the rollover alias issue?

Thank you..!
Hiruni

2

Hi!
Could you try the explain API to get some more info on the ILM explain API?

For your error message:

You need to explicitly configure this alias one time when you bootstrap the initial index.
The index.lifecycle.rollover_alias setting must be configured for the rollover action to work.
Update the index settings to set index.lifecycle.rollover_alias

3

Thank you for the reply.

But I want to know how to add the rollover_alias setting for indices that are created daily.(as follows)
abc-asd-
abc-asd-2023-10-09
abc-asd-2023-10-10
abc-asd-2023-10-11

I understand the error message, but I wanted to rollover_alias for above index types.

Thank you..!
Hiruni

4

Alright, sorry for not properly understanding the request :slight_smile:

You mentioned you don't have a function running to create the indices, so I assume no data stream setup? How are the indices created? You can give them an alias at creation depending of the method?

If you're looking at automation for daily changing indices; take a look at this process. You create a lifecycle policy, and a template index with your "abc-asd-*" format and give it an alias through the wizard.

Is this what you are looking into?

5

Thank you for the reply.

Daily indices are created by a script in internal application and push the data to Elastic cluster.

I can create an index template for these indices. But I cannot add them to the ILM policy. Even I tried to disable the rollover, but it didn't work.

Even if I can create ILM policy for deletion phase, that is also fine for me.

Thank you..!
Hiruni

6

Rolling index requires the hard/actual index to end with -000001 when you created the index.

You create the index "abc-asd-2023-10-09-000001" with alias "abc-asd-2023-10-09" pointing to it (part of settings in the create index API payload).

Then when you issue the rollover index api with the rollover criteria, if it's met, then it'll create a new index name "abc-asd-2023-10-09-000002" and point the alias "abc-asd-2023-10-09" to it automatically. So all your future writes to "abc-asd-2023-10-09" will ended up in the index "abc-asd-2023-10-09-000002", etc.

When searching, you just use wildcard to search "abc-asd-2023-10-09*" for all the documents on that day.

I have not tried ILM so not sure how much of this is applicable. But rolling index is what I explained above.

7

Hi,

Thank you for the reply.
Yes, It's not necessary to rollover the index. This index pattern already have daily index. I want to add these indices to ILM policy to automate the index deletion.

Hiruni

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.