ILM Policy - Help!>!>!>

Elastic Stack Elasticsearch
1

Hello,

I have set up an index called filebeat-7-7-1*, which creates a daily index for my filebeat logs. So far so good - elastic creates a new index daily, which fills up with logs and all the other good stuff I need.

However, I soon run out of storage space as my ILM policy doesn't rollover after the hot phase, nor does it delete the indices after the designated time. The below error message appears on each and every index:

"setting [index.lifecycle.rollover_alias] for index [filebeat-7.7.1-2020.09.22] is empty or not defined",

I have the following ilm policy (nothing too complex):

    PUT _ilm/policy/filebeat-7.7
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_age": "3d",
            "max_size": "10gb"
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "delete": {
        "min_age": "5d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

I have the following in my index template.

{
  "index": {
"lifecycle": {
  "name": "filebeat-7.7",
  "rollover_alias": "filebeat-7.7.1-0000N"
}
  }
}

Any help would be most appreciated as to where I'm going wrong.

Thanks,

2

Try;

PUT /filebeat-7.7.1-2020.09.22/_alias/filebeat-7.7

Then change;

With;

"rollover_alias": "filebeat-7.7.1"

You don't want to use filebeat-7.7.1-0000N as the alias, because ILM adds the -0000N part automatically when it rolls over.

3

Hi Mark,

Is this command correct?
shouldn't it be :
PUT /filebeat-7.7.1-2020.09.22/_alias/filebeat-7.7.1 ?
because I think your solution is to add rollover_alias to index aliases, am I correct?

4

Thanks guys - assuming one of those variants works for the index created on the 22nd Sept, how does that then work for each index created on a daily basis? Presumably I don't need to go through and manually set the alias on each index?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.