How to setup ILM in elastic search

[rahulkothanath (Rahul)]

I am confused about creating an ILM policy with roll over when index size goes beyond 190gb.

I have followed below steps to it.

1. Defined ILM policy in elastic search.
   PUT _ilm/policy/abcd_foundation_policy
   {
   "policy": {
   "phases": {
   "hot": {
   "min_age": "0ms",
   "actions": {
   "rollover": {
   "max_size": "190gb",
   "max_age": "31d"
   },
   "set_priority": {
   "priority": 100
   }
   }
   },
   "delete": {
   "min_age": "120d",
   "actions": {
   "delete": {}
   }
   }
   }
   }
   }

2. defined "abcd_foundation_policy" policy in my index template with roll over alias name.
   below is the template settings.
   "index_patterns" : [
   "abcd_foundation"
   ],
   "settings" : {
   "index" : {
   "lifecycle" : {
   "name" : "abcd_foundation_policy",
   "rollover_alias" : "write_abcd_foundation"
   },
   "mapping" : {
   "ignore_malformed" : "true"
   },
   "number_of_shards" : "6",
   "number_of_replicas" : "1"
   }
   }

I am confused with the next step . can i start pushing data into roll over alias "write_abcd_foundation" as defined in the template? or should I insert data first into a sample index abcd_foundation_00001.

I am also confused with where to define "is_write_index": true property for my roll over alias.

Thanks for help.

[rugenl (Len Rugen)]

You read and write via the alias.

All indices will have the alias, so reading refers to all of them. Only one can have is_write_alias: True, so writes are directed to it.

Rollover creates a new index -nnnnnn + 1 then sets is_write_alias: True for the new index causing writes to move from the old index to the new.

You can PUT to create the new index without adding a document, From the manual:

PUT datastream-000001
{
  "aliases": {
    "datastream": {
      "is_write_index": true
    }
  }
}