ILM not deleting indices in data_stream

Elastic Stack Elasticsearch
1

Hello!
So I've been checking out new features of ELK stack - created a template for data stream and connected a basic ILM policy to it.
ILM policy is basically:

 {
   "policy": {
     "phases": {
       "hot": {
         "min_age": "0ms",
         "actions": {
           "forcemerge": {
             "max_num_segments": 1,
             "index_codec": "best_compression"
           },
           "rollover": {
             "max_size": "5gb",
             "max_age": "30d"
           },
           "set_priority": {
             "priority": 100
           }
         }
       },
       "delete": {
         "min_age": "1d",
         "actions": {}
       }
     }
   }
 }

Problem I encountered is that even tho ILM says the deletion phase was a success I still can see all those indices in Data Stream being totally active and .. totally open. It seems ILM didn't delete them even though API says it did:

 {
  "indices" : {
     ".ds-xxxxxxxxxx-000001" : {
       "index" : ".ds-xxxxxxxxx-000001",
       "managed" : true,
       "policy" : "poc_policy",
       "lifecycle_date_millis" : 1606834534205,
       "age" : "5.69d",
       "phase" : "delete",
       "phase_time_millis" : 1606921534194,
       "action" : "complete",
       "action_time_millis" : 1606835134195,
       "step" : "complete",
       "step_time_millis" : 1606921534194,
       "phase_execution" : {
         "policy" : "poc_policy",
          "phase_definition" : {
           "min_age" : "1d",
           "actions" : { }
         },
         "version" : 3,
         "modified_date_in_millis" : 1606816056890
       }
     }
   }
 }

Is this a known bug or did I do something wrong ?

2

Hi Zerobot,

Your policy is close! It's missing the actual delete action though:

"delete": {
  "min_age": "1d",
  "actions": {}
}

Should look like:

"delete": {
  "min_age": "1d",
  "actions": {
    "delete": {}
  }
}

Hope that helps!

2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.