ILM Policy interval is later than configured

Elastic Stack Logstash
1

Hi, I have created the following ILM Policy for testing:

{
  "test-1-m": {
    "version": 6,
    "modified_date": "2022-12-07T11:27:55.648Z",
    "policy": {
      "phases": {
        "hot": {
          "min_age": "0ms",
          "actions": {
            "rollover": {
              "max_primary_shard_size": "10mb",
              "max_age": "1m"
            }
          }
        },
        "delete": {
          "min_age": "1m",
          "actions": {
            "delete": {
              "delete_searchable_snapshot": true
            }
          }
        }
      }
    },
    "in_use_by": {
      "indices": [
        "monitoring-logstash-alias-000008",
        "monitoring-logstash-alias-000009",
        "monitoring-logstash-alias-000010"
      ],
      "data_streams": [],
      "composable_templates": [
        "monitoring-logstash-alias"
      ]
    }
  }
}

The shard is rolled over but after 10 minutes instead of 1 as configured.
The 10 MB threshold is not applied at all.

Am I missing something?

2

Hi ,

ILM check for every 10m and rollover , You need to customize the value to 1m for your requirement by modifyig below cluster setting (Not recommended for production system to have 1m poll as it may bring performance issues)

indices.lifecycle.poll_interval
(Dynamic, time unit value) How often index lifecycle management checks for indices that meet policy criteria. Defaults to 10m.

2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.