ilm policy delete action is disable but index is still be deleted

[frank_spr (frank)]

My Elasticsearch index is managed by IML. Recently, I discovered that my index has been deleted for no reason, so I disabled the delete operation in the IML policy. However, I found that my index will still be deleted

1、ilm policy

{
"applog_devops_policy" : {
"version" : 5,
"modified_date" : "2023-06-30T06:18:16.461Z",
"policy" : {
"phases" : {
"hot" : {
"min_age" : "0ms",
"actions" : {
"rollover" : {
"max_size" : "100gb",
"max_age" : "480h"
},
"set_priority" : {
"priority" : 100
}
}
},
"warm" : {
"min_age" : "24h",
"actions" : {
"allocate" : {
"number_of_replicas" : 0,
"include" : { },
"exclude" : { },
"require" : { }
},
"set_priority" : {
"priority" : 50
}
}
}
}
}
}
}

2、template

{
"devops-applog-k8s-prod_template" : {
"order" : 1,
"index_patterns" : [
"devops-applog-k8s-prod-*"
],
"settings" : {
"index" : {
"lifecycle" : {
"name" : "applog_devops_policy",
"rollover_alias" : "devops-applog-k8s-prod"
},
"routing" : {
"allocation" : {
"require" : {
"rack" : "hot"
}
}
},
"search" : {
"slowlog" : {
"level" : "info",
"threshold" : {
"fetch" : {
"warn" : "3s",
"trace" : "300ms",
"debug" : "700ms",
"info" : "900ms"
},
"query" : {
"warn" : "12s",
"trace" : "3s",
"debug" : "5s",
"info" : "7s"
}
}
}
},
"refresh_interval" : "30s",
"indexing" : {
"slowlog" : {
"level" : "info",
"threshold" : {
"index" : {
"warn" : "12s",
"trace" : "800ms",
"debug" : "3s",
"info" : "7s"
}
},
"source" : "1000"
}
},
"number_of_shards" : "4",
"translog" : {
"sync_interval" : "30s",
"durability" : "async"
},
"max_result_window" : "100000",
"number_of_replicas" : "1"
}
},
"mappings" : {
"_routing" : {
"required" : false
},
"numeric_detection" : false,
"dynamic_date_formats" : [
"strict_date_optional_time",
"yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
],
"_meta" : { },
"_source" : {
"excludes" : [ ],
"includes" : [ ],
"enabled" : true
},
"dynamic" : true,
"dynamic_templates" : [
{
"strings_as_text" : {
"mapping" : {
"norms" : false,
"ignore_above" : 12800,
"type" : "text",
"index_options" : "positions"
},
"match_mapping_type" : "string"
}
}
],
"date_detection" : true,
"properties" : {
"app" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"fields.project_name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"fields.env" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"reallogpath" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"cost_ms" : {
"type" : "integer"
},
"level" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"fields.type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"nodeip" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"unique_appname" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"podip" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"[@timestamp](https://github.com/timestamp)" : {
"type" : "date"
},
"fields.class" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
},
"loglevel" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword"
}
}
}
}
},
"aliases" : { }
}
}

deleting log
[2023-06-30T00:19:22,737][INFO ][o.e.c.m.MetaDataDeleteIndexService] [master2.cloud] [devops-applog-k8s-prod-000033/0Aatnq24RSWX58HWgNImww] deleting index
[2023-06-30T00:19:39,778][INFO ][o.e.c.m.MetaDataDeleteIndexService] [master2.cloud] [devops-applog-k8s-prod-000032/XhUJw2GWQ8SqcuxSHL6liw] deleting index
[2023-06-30T00:19:56,958][INFO ][o.e.c.m.MetaDataDeleteIndexService] [master2.cloud] [devops-applog-k8s-prod-000031/i73Up221TieIXVubbKWBhg] deleting index

[stephenb (Stephen Brown)]

Have you changed the ILM policy?

If so it may the update may Not have taken affect.

I see version

"version" : 5,

You need to look at the _ilm/explain for your indices

Also please format your code... It makes it really hard to read.. often poorly formatted post just get ignored.

Use three ticks line before "```" and after

[leandrojmp (Leandro Pereira)]

As I mentioned on the github issue that was opened and closed about this:

I'm not sure this is a bug, are those deleted indices on the warm phase before you changed your policy? When you change a ILM policy the index will still use a cached version of it and start using the new policy when it moves to the next phase, but if your next phase is delete I don't think this will make any difference.