# ILM policy for custom index

**URL:** <https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [June 6, 2023, 5:25am UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271 "2023-06-06T05:25:37Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![lalchand\_rajak](https://avatars.discourse-cdn.com/v4/letter/l/8e7dd6/32.png) [@lalchand\_rajak](https://discuss.elastic.co/u/lalchand_rajak)\
**Post date:** [June 6, 2023, 5:25am UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271/1 "2023-06-06T05:25:37Z")

</div>

Hello,

I am unable to apply ILM policy to custom index coming from Openshift cluster log forwarding. As It create index with app-write and does not have any aliases.

GET app-write/\_ilm/explain output

```auto
{
  "indices": {
    "app-write": {
      "index": "app-write",
      "managed": false
    }
  }
}

```

Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![lachlann562](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lachlann562/32/85698_2.png) [@lachlann562](https://discuss.elastic.co/u/lachlann562)\
**Post date:** [June 6, 2023, 1:37pm UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271/3 "2023-06-06T13:37:36Z")

</div>

Hi @Ofir_Edi i believe you tagged the wrong person.

---

<div class="post-metadata">

**Author:** ![Ofir\_Edi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ofir_edi/32/78181_2.png) [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\
**Post date:** [June 6, 2023, 2:08pm UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271/4 "2023-06-06T14:08:46Z")

</div>

Thanks, repositing.

Hi @lalchand_rajak ,  
Have you tried using an index template ?

By doing so you can instruct elasticsearch that every time a new index is created with certain pattern it will be given settings and mappings as stated in the template.

For example, inex template for all indices starts with app-write will get ILM policy test-policy:

```auto
PUT _index_template/app_write_template
{
    "index_patterns": [
        "app-write*"
    ],
    "template": {
        "settings": {
            "index": {
                "lifecycle": {
                    "name": "test-policy"
                }
            }
        },
        "mappings": {},
    "composed_of": []
	}
}

```

also you can manually assign ILM policy to existing index using PUT settings

```auto
PUT app-write/_settings
{
   "index": {
                "lifecycle": {
                    "name": "test-policy"
                }
     }
}

```

Hopes this help,  
Ofir

---

<div class="post-metadata">

**Author:** ![lalchand\_rajak](https://avatars.discourse-cdn.com/v4/letter/l/8e7dd6/32.png) [@lalchand\_rajak](https://discuss.elastic.co/u/lalchand_rajak)\
**Post date:** [June 7, 2023, 6:05am UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271/5 "2023-06-07T06:05:18Z")

</div>

Hi,  
I have tried the suggested the changes. but now getting the below error.

```auto
{
  "indices": {
    "app-write": {
      "index": "app-write",
      "managed": true,
      "policy": "app-write",
      "index_creation_date_millis": 1685791382524,
      "time_since_index_creation": "3.77d",
      "lifecycle_date_millis": 1685791382524,
      "age": "3.77d",
      "phase": "hot",
      "phase_time_millis": 1686116928468,
      "action": "rollover",
      "action_time_millis": 1686114592688,
      "step": "ERROR",
      "step_time_millis": 1686117528554,
      "failed_step": "check-rollover-ready",
      "is_auto_retryable_error": true,
      "failed_step_retry_count": 2,
      "step_info": {
        "type": "illegal_argument_exception",
        "reason": "setting [index.lifecycle.rollover_alias] for index [app-write] is empty or not defined"
      },
      "phase_execution": {
        "policy": "app-write",
        "phase_definition": {
          "min_age": "0ms",
          "actions": {
            "rollover": {
              "max_size": "10gb",
              "max_primary_shard_size": "10gb",
              "max_age": "1d"
            }
          }
        },
        "version": 8,
        "modified_date_in_millis": 1686113759464
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Ofir\_Edi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ofir_edi/32/78181_2.png) [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\
**Post date:** [June 7, 2023, 8:50am UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271/6 "2023-06-07T08:50:34Z")

</div>

Hi,  
Now your index has ILM policy linked to it (as opposed to the initial state where it wasn't managed).  
The error you see occurs because your ILM policy has rollover action in it but you index was not preconfigured for rollover.  
here is what you can do:

1. don't use rollover for your index and add date or any other name identifier for you index - you will beable to move it to warmer nodes over time and delete it eventually.
2. bootsrap your index for rollover. Tutorial here[Tutorial here](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html#ilm-gs-alias-bootstrap).
3. use data stream insted of index: [link](https://www.elastic.co/guide/en/elasticsearch/reference/current/data-streams.html)

---

<div class="post-metadata">

**Author:** ![lalchand\_rajak](https://avatars.discourse-cdn.com/v4/letter/l/8e7dd6/32.png) [@lalchand\_rajak](https://discuss.elastic.co/u/lalchand_rajak)\
**Post date:** [June 7, 2023, 10:40am UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271/7 "2023-06-07T10:40:51Z")

</div>

Hi,

the issue is that OpenShift forward log to Elasticsearch and it create index as app-write only. How can i create ILM for such index.

---

<div class="post-metadata">

**Author:** ![lalchand\_rajak](https://avatars.discourse-cdn.com/v4/letter/l/8e7dd6/32.png) [@lalchand\_rajak](https://discuss.elastic.co/u/lalchand_rajak)\
**Post date:** [June 8, 2023, 5:06am UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271/8 "2023-06-08T05:06:56Z")

</div>

I tried above 2 steps but does not work. The index require aliases. Once I added manually index get deleted but once deleted the index then again index does not have the aliases. how can I add aliases in template itself in below

```auto
PUT _index_template/app_write_template
{
    "index_patterns": [
        "app-write*"
    ],
    "template": {
        "settings": {
            "index": {
                "lifecycle": {
                    "name": "test-policy"
                }
            }
        },
        "mappings": {},
    "composed_of": []
	}
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2023, 5:07am UTC](https://discuss.elastic.co/t/ilm-policy-for-custom-index/335271/9 "2023-07-06T05:07:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.