ILM policy trigerring late

[maheshe (Mahesh)]

Hi : I am trying to dev test the ILM template by specifying the below...

The rollover happens after a few minutes and after it reaches like 750KB instead of 10 KB as mentioned in ILM. Why is it not rolling over as soon as it reaches 10kb itself

----------------------ILM Policy:---------------------------------------------------

{
  "PolicyILMTester" : {
    "version" : 3,
    "modified_date" : "2021-02-25T05:44:39.321Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "10kb",
              "max_age" : "1m"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        }
      }
    }
  }
}

-------------------------------------------Index template & Index creation- bootstrapped-----------------------------

PUT _index_template/eventaudit_template
{
  "index_patterns": ["event.intune-api_data-*"],                 
  "template": {
    "settings": {
      "number_of_replicas": 0,
      "index.lifecycle.name": "PolicyILMTester",      
      "index.lifecycle.rollover_alias": "event.intune-api_data"    
    }
  }
}

PUT event.intune-api_data-2021-02-24-000001
{
  "aliases": {
    "event.intune-api_data": {
      "is_write_index": true
    }
  }
}

[Wolfram_Haussig]

Hello Mahesh,

ElasticSearch has a setting indices.lifecycle.poll_interval (see here for details) which describes how often ElasticSearch for indices that meet the ILM criterias. The default value is 10 minutes. Although this overruns your limit in your test this should be fine for most usecases in reality.

Best regards
Wolfram

[maheshe (Mahesh)]

Thank you @Wolfram_Haussig . This clarifies.