ILM is deleting after rollover

Elastic Stack Elasticsearch
1

Hi,

I have set rollover after 10gb and delete after 7 days.

PUT _ilm/policy/policy1
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_primary_shard_size": "10gb"
          }
        }
      },
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

I am expecting that the index will be deleted 7 days after rollover.
But actually it delete it on the same day.
Why?

2

Hi @

Can you run

GET myindex/_ilm/explainon one of the indices.

and run

GET _ilm/policy/policy1

Technically, the PUT should look like this

PUT _ilm/policy/policy1
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_primary_shard_size": "10gb"
          },
          "set_priority": {
            "priority": 100
          }
        },
        "min_age": "0ms"
      },
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}
3 
{
  "indices" : {
    "base_elements_rwr_policy1-2023.11.12-000001" : {
      "index" : "base_elements_rwr_policy1-2023.11.12-000001",
      "managed" : true,
      "policy" : "policy1",
      "lifecycle_date_millis" : 1699747200000,
      "age" : "59.64d",
      "phase" : "hot",
      "phase_time_millis" : 1699792177855,
      "action" : "rollover",
      "action_time_millis" : 1699792177870,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1699792177870,
      "phase_execution" : {
        "policy" : "policy1",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_primary_shard_size" : "10gb"
            }
          }
        },
        "version" : 4,
        "modified_date_in_millis" : 1701940116889
      }
    }
  }
}

I am suspecting that it occur due to setting "index.lifecycle.parse_origination_date": true in index template.
4

What version of elasticserach are you on? Important :slight_smile:

So this is what I see...

Couple things... You will notice there is no max_age.... so can you run

GET _ilm/policy/policy1

I suspect that index is under Version 4 which did not have a max age and then you added max_age to a later version but that does not take affect on this index.

        "version" : 4,
        "modified_date_in_millis" : 1701940116889

and in that version, there was no max_age and since it is already in that in the check rollover phase that index is tied to that version... so you will need to rollover manually.

But that new ILM policy should work on newer indices.

6

I am suspecting that it occur due to setting "index.lifecycle.parse_origination_date": true in index template.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.