ILM policy - why isn't it deleting?

Indices are building up instead of being deleted. Here's the policy:

GET _ilm/policy/packetbeat
{
  "packetbeat" : {
    "version" : 6,
    "modified_date" : "2020-12-21T12:30:41.023Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "5gb",
              "max_age" : "3h"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "21h",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    }
  }
}

(Note that I didn't specify the 'delete_searchable_snapshot' param - that just showed up)

Looking at the matched indices I see that the majority are marked as 'delete phase' (which I would expect) but are still 'open' and 'green'. Why aren't they going away?

Thanks for using Elasticsearch.

Can you post the output of the _ilm/explain API for the managed indices you expected to have been deleted?

A few other things to double check:

1 Like

Here is the _ilm/explain:

{
  "indices" : {
  "packetbeat-000060" : {
  "index" : "packetbeat-000060",
  "managed" : true,
  "policy" : "packetbeat",
  "lifecycle_date_millis" : 1608606522692,
  "age" : "6.39d",
  "phase" : "delete",
  "phase_time_millis" : 1608682123480,
  "action" : "complete",
  "action_time_millis" : 1608606524983,
  "step" : "complete",
  "step_time_millis" : 1608682123480,
  "phase_execution" : {
    "policy" : "packetbeat",
    "phase_definition" : {
      "min_age" : "21h",
      "actions" : { }
    },
    "version" : 5,
    "modified_date_in_millis" : 1608205781061
  }
}
  }
}

Im not sure how to go about finding the other pieces of information

It seems like the delete phase does not define a delete action. We should prevent this from happening and we have an issue to track this problem.
This is visible under phase_definition in the explain output.

You can update the policy definition using the PUT lifecycle API and include a delete action.

eg.

    "policy": {
      "phases": {
   
        ...    

        "delete": {
          "min_age": "21h",
           "actions": {
             "delete": {}
           }
        }
     }
  }

This will make sure the future indices managed by the policy will get deleted. The existing ones (eg. packetbeat-000060) will have to manually be deleted as they are already in the complete step in the delete phase and won't be picked up for automatic deletion.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.