ILM not triggering delete phase

Elastic Stack Elasticsearch
1

Hello,

I've been playing around with Index Lifecycle Management lately. Things are working more or less as expected. Indices are rolled over as defined in the ilm policy.

What does not seem to be working is the delete phase. Somehow indices older then the configured amount of time in the delet phase of the ilm policy are not deleted.

My ilm policy:

{
  "ilm_policy_sflow" : {
    "version" : 13,
    "modified_date" : "2019-05-09T13:52:21.731Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "250mb",
              "max_age" : "2d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "4d",
          "actions" : {
            "delete" : { }
          }
        }
      }
    }
  }
}

My indices which have the above policy:

health status index                   pri rep docs.count docs.deleted store.size memory.total
green  open   sflow-2019.05.09-000001   2   1    4147111            0        2gb        3.8mb
green  open   sflow-2019.05.10-000002   2   1    1008748            0    511.8mb        1.2mb
green  open   sflow-2019.05.10-000003   2   1    1008827            0    513.1mb        1.2mb
green  open   sflow-2019.05.11-000004   2   1    1008801            0    513.1mb        1.1mb
green  open   sflow-2019.05.11-000005   2   1    1008727            0    511.8mb          1mb
green  open   sflow-2019.05.11-000006   2   1    1008760            0    511.8mb        1.1mb
green  open   sflow-2019.05.11-000007   2   1    1008817            0    512.3mb        1.1mb
green  open   sflow-2019.05.12-000008   2   1    1008802            0    512.2mb        1.2mb
green  open   sflow-2019.05.12-000009   2   1    1008771            0    512.1mb        1.1mb
green  open   sflow-2019.05.12-000010   2   1    1008813            0    512.9mb          1mb
green  open   sflow-2019.05.12-000011   2   1    1008736            0    509.1mb          1mb
green  open   sflow-2019.05.13-000012   2   1    1008862            0    512.4mb        1.1mb
green  open   sflow-2019.05.13-000013   2   1     539250            0    276.2mb       14.4mb

An explain on the current write index:

GET sflow-2019.05.13-000013/_ilm/explain
{
  "indices" : {
    "sflow-2019.05.13-000013" : {
      "index" : "sflow-2019.05.13-000013",
      "managed" : true,
      "policy" : "ilm_policy_sflow",
      "lifecycle_date_millis" : 1557727128647,
      "phase" : "hot",
      "phase_time_millis" : 1557727128760,
      "action" : "rollover",
      "action_time_millis" : 1557727728703,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1557727728703,
      "phase_execution" : {
        "policy" : "ilm_policy_sflow",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "250mb",
              "max_age" : "2d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "version" : 13,
        "modified_date_in_millis" : 1557409941731
      }
    }
  }
}

Please advise how to get the delete phase working.

Willem

2

Can you please let me know as to where can we add this policy for index?

3

Hi Willem,

Could you post the output of the _ilm/explain API for at least one of the indices that you expect to have been deleted?

Edit to be clear: Not the current one, but for one which is more than 4 days past rollover, that you would expect to have already been deleted per your ILM policy. For example,sflow-2019.05.09-000001 (although any index that meets this criteria will be fine, it doesn't have to be that one in particular).

4

@gbrown In the meantime it seems the sflow indices started deleting after all. So Consider this case closed.

5

Hi Willem ,

May I know where have you set this to policy in which file ?

6

@syed_faheem_Hussain Does the ILM Getting Started Guide help?

If not, could you please create a new topic with your question, rather than reusing this one? That will allow more people to see your question and repsond, and make it easier for other people with the same question to find it in the future.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.