ILM policy - why isn't it deleting?

Elastic Stack Elasticsearch
1

Indices are building up instead of being deleted. Here's the policy:

GET _ilm/policy/packetbeat
{
  "packetbeat" : {
    "version" : 6,
    "modified_date" : "2020-12-21T12:30:41.023Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "5gb",
              "max_age" : "3h"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "21h",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    }
  }
}

(Note that I didn't specify the 'delete_searchable_snapshot' param - that just showed up)

Looking at the matched indices I see that the majority are marked as 'delete phase' (which I would expect) but are still 'open' and 'green'. Why aren't they going away?

2

Thanks for using Elasticsearch.

Can you post the output of the _ilm/explain API for the managed indices you expected to have been deleted?

A few other things to double check:

1 Like
3

Here is the _ilm/explain:

{
  "indices" : {
  "packetbeat-000060" : {
  "index" : "packetbeat-000060",
  "managed" : true,
  "policy" : "packetbeat",
  "lifecycle_date_millis" : 1608606522692,
  "age" : "6.39d",
  "phase" : "delete",
  "phase_time_millis" : 1608682123480,
  "action" : "complete",
  "action_time_millis" : 1608606524983,
  "step" : "complete",
  "step_time_millis" : 1608682123480,
  "phase_execution" : {
    "policy" : "packetbeat",
    "phase_definition" : {
      "min_age" : "21h",
      "actions" : { }
    },
    "version" : 5,
    "modified_date_in_millis" : 1608205781061
  }
}
  }
}

Im not sure how to go about finding the other pieces of information

4

It seems like the delete phase does not define a delete action. We should prevent this from happening and we have an issue to track this problem.
This is visible under phase_definition in the explain output.

You can update the policy definition using the PUT lifecycle API and include a delete action.

eg.

    "policy": {
      "phases": {
   
        ...    

        "delete": {
          "min_age": "21h",
           "actions": {
             "delete": {}
           }
        }
     }
  }

This will make sure the future indices managed by the policy will get deleted. The existing ones (eg. packetbeat-000060) will have to manually be deleted as they are already in the complete step in the delete phase and won't be picked up for automatic deletion.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.