Hello, this is a weird one because there's no way for us to tie this to any specific event but it seems that a custom ILM policy and also the relative index template that we define for some of our indices disappear after some time.
If it's of any help, the index template was named ".history_template" and the ILM policy ".history_policy", might it have been because they start with a dot they are managed by the system and possibly deleted?
Items with a dot at the start of the name are usually considered system managed things, yes.
I am not sure if that means they will be deleted automatically.
Can you try it without the dot?
I re-created them without the dot this time and will keep an eye on things to see if they get deleted once again. As a matter of fact we have some other templates and policies that are basically identical and are working correctly hence my assumption regarding the dot.
It still seems weird to me that they would get deleted just like that though, might be worth checking out and maybe mentioning in the docs if that's the case.
Is there anything in your Elasticsearch logs that refer to these?
I tried to look but couldn't find anything, but we don't hold onto Elastic logs for long and the indices affected haven't rolled over since February (they should roll monthly) so we probably didn't notice when it happened and the logs are gone.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.