ILM policies - fails to move to cold node

Elastic Stack Elasticsearch
1

We have a slightly old Elastic stack that I built over 2+ years ago. It ran into some issues a week or so ago and one of the team took a bit of a sledge hammer to the indices to fix it. It's now back up and running but I've got an issue whereby the only index that it is ingesting (winlogbeats from many Windows servers), is not following the ILM policy that has been assigned to it. I suspect the reason for this is that the index template setting now contains the following:

    "routing": {
      "allocation": {
        "require": {
          "data": "hot"
        }
      }
    },

I'm guessing that is what is preventing it from being moved over to the cold node when the policy should trigger. As it's been nearly 3 years since touching it, I need a memory jog. If I don't have the "require hot" in there, the cold node then ends up becoming part of the wider cluster and gets indices written to it from memory. If I do put it in there, it prevents the index from ever being archived to the cold node.

What's the solution?

Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.