ILM deleted indices before reaching min_age

Elastic Stack Elasticsearch
1

Problem

We have set the following index management policy for indices, which moves the index to delete phase after 32 days & then once the snapshot is completed the index will be deleted.

{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {}
      },
      "delete": {
        "min_age": "32d",
        "actions": {
          "delete": {
          },
          "wait_for_snapshot": {
            "policy": "recurring-snapshots"
          }
        }
      }
    }
  }
}

Recently, all the indices got deleted before they reached the min_age i.e 32 days. However after restoring the data from the snapshot the ILM is again working fine. We checked the trigger for index deletion & it was indeed done by the same policy and wasn't a manual trigger. Checked this through logs.

Debugging approach

  1. Check when the index was deleted through logs
  2. Check through .ds-ilm-history-* index pattern for the trigger of ILM moving the index to delete phase, also checked the phase_definition on the document given here as an output the definition wasn't modified.

Questions.

  1. Is there a way to find how did such a event got triggered?
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.