ILM policy not working as expected

Elastic Stack Elasticsearch
1

Hi Team,

We have implemented ILM policies to cleanup indexes automatically after 14 days. But I see some old indexes still present with less documents count and Storage size whose min age is passed more than 14 days. Below are ilm policy and delete template.

Its deleting the index as i see another index with latest date, but i see indexes remain there with less documents count and Storage size for old dates (which need to be deleted by that time as per ILM policy). Please check and let us know did we missed anything here.

PUT _ilm/policy/infra_delete_policy
{
"policy": {
"phases": {
"hot": {
"actions": {}
},
"delete": {
"min_age": “14d",
"actions": {
"delete": {}
}
}
}
}
}

  1. Applying a policy to index template

PUT _template/infra_delete_template
{
"index_patterns": ["infra-*"],
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1,
"index.lifecycle.name": "infra_delete_policy"
}
}

2

If you are not using rollover, the index a document is sent to is often determined by the timestamp. If you have old data coming in, belonging to indices that have already been deleted, these would get recreated with the new data.

3

[quote="reddy1262, post:1, topic:233504"]
PUT _template/infra_delete_template
{
"index_patterns": ["infra-*"],
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1,
"index.lifecycle.name": "infra_delete_policy"
"index.lifecycle.rollover_alias": "infra-alias"
}
}

Thanks Chris, does above syntax will work for rollover ? or can you explain me how rollover need to be added for all existing delete templates

4

@Christian_Dahlqvist could you please confirm on above syntax

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.