ILM: index not showing in Cold phase and Delete phase

Elastic Stack Elasticsearch
1

Hi,
I'm using Winlogbeat and i've defined a lifecycle with the following phases: Hot, Warm, Cold and Delete. In Index Management i have indices only for Hot and Warm phases.
Could someone tell me what is wrong?
Any help will be appreciated.

Thank you!

2

Here is my ILM Policy

PUT _ilm/policy/winlogbeat
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "1d",
"max_size": "3gb"
},
"set_priority": {
"priority": 100
}
}
},
"warm": {
"actions": {
"allocate": {
"include": {},
"exclude": {},
"require": {
"box_type": "warm"
}
},
"set_priority": {
"priority": 50
}
}
},
"delete": {
"min_age": "150d",
"actions": {
"delete": {
"delete_searchable_snapshot": true
}
}
}
}
}
}

3

The policy you defined only has hot, warm and delete. There's no cold that I can see.

4

Also that's pretty small. You might want to look at increasing the age and size to something a little larger to make sure you are using your cluster resources effectively.

5

Thanks. I added the missing node and It works fine now.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.