# ILM is not working as per parameter

**URL:** <https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [January 14, 2021, 6:15am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077 "2021-01-14T06:15:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shoaib\_akram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shoaib_akram/32/82210_2.png) [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\
**Post date:** [January 14, 2021, 6:15am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077/1 "2021-01-14T06:15:51Z")

</div>

HI,

here is my policy and template and attached conf file, 4100+ documents ingested successfully but it is not rolled over on 1000 doc check please help me out why it is not rolling over

## Here is my conf content

input {  
file {  
codec =\> "json"  
path =\> "/home/shoaib/searlite\_latest\_data.json"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"

# max\_open\_files =\> 10000

#ignore\_older =\> 0  
}  
}  
filter {  
json {  
source =\> "url"  
}  
grok {  
match =\> ["url", "^(?:https?://)?(?:www.)?(?[^/:]+)\S\*"]  
}

# skip droped malicious to inser

#if "dropped\_malicious" in [path] {

# drop{}

# }

# change url type on the basis of directory

if "repute" in [path] and [t] == "b" {  
mutate { replace =\> { "t" =\> "rb" } }  
}

if "repute" in [path] and [t] == "d" {  
mutate { replace =\> { "t" =\> "rd" } }  
}

if "scan" in [path] and [t] == "b" {  
mutate { replace =\> { "t" =\> "sb" } }  
}

if "scan" in [path] and [t] == "d" {  
mutate { replace =\> { "t" =\> "sd" } }  
}

}  
output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "timeseries"

# document\_id =\> "%{hostname}%{created\_at}"

}

stdout { }  
}

######################## API ####################################

PUT /\_ilm/policy/timeseries\_policy?pretty  
{  
"policy": {  
"phases": {  
"hot": {  
"actions": {  
"rollover": {  
"max\_docs": 1000  
}  
}  
}  
}  
}  
}

PUT /\_index\_template/timeseries\_template?pretty  
{  
"index\_patterns": ["timeseries-\*"],  
"template": {  
"settings": {  
"number\_of\_shards": 1,  
"number\_of\_replicas": 0,  
"index.lifecycle.name": "timeseries\_policy",  
"index.lifecycle.rollover\_alias": "timeseries"  
}  
}  
}

PUT /timeseries-000001?pretty  
{  
"aliases": {  
"timeseries": {  
"is\_write\_index": true  
}  
}  
}

GET /timeseries-\*/\_ilm/explain?format

POST /timeseries/\_doc?pretty  
{  
"@timestamp": "1591890611",  
"url": "[http://2266608xyzshjd/register?key=1000350241](http://2266608xyzshjd/register?key=1000350241)",  
"customer\_name": "fareed",  
"created\_at": "2020-11-11 10:57:40.843094",  
"hostname": "vm1-searcliteapi-v2",  
"t": "m",  
"s": "r",  
"domain": "2266608xyzshjd"  
}

############################# end #################################

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 15, 2021, 12:00am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077/2 "2021-01-15T00:00:54Z")

</div>

Welcome to our community! 😃

Can you please reformat your code/logs/config using the `</>` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂

---

<div class="post-metadata">

**Author:** ![shoaib\_akram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shoaib_akram/32/82210_2.png) [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\
**Post date:** [January 15, 2021, 7:18am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077/3 "2021-01-15T07:18:25Z")

</div>

Hi Warkolm,  
thanks fro reply.

Now i am able to implement rollever api by setting the poll\_interval": "1s" now it willl check againa and again after 1s and rollover index after reaching the limit max\_doc condition.

`PUT /_cluster/settings { "transient": { "indices.lifecycle.poll_interval": "1s" } } `  
but now i am facing issue that after creating multiple indices shortly i need to flush data then rollover work else it going to ingest data more then the defined max doc limit.  
what is the automatic solution and after that i want to ingest data through log-stash. either it would be possible ther as well ?

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 15, 2021, 7:46am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077/4 "2021-01-15T07:46:45Z")

</div>

1 second is too small of a resolution for ILM to operate.

> [@shoaib\_akram](#):
>
> but now i am facing issue that after creating multiple indices shortly i need to flush data then rollover work else it going to ingest data more then the defined max doc limit.

That might happen due tot he nature of distributed systems. But unless you have extremely small sizes does it matter?

---

<div class="post-metadata">

**Author:** ![shoaib\_akram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shoaib_akram/32/82210_2.png) [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\
**Post date:** [January 15, 2021, 9:22am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077/5 "2021-01-15T09:22:08Z")

</div>

for the testing purpose i have set this later i will set it to 1m when we move to production.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2021, 9:22am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077/6 "2021-02-12T09:22:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.